Unverified_a152 exploit analysis

Seven Ethereum addresses that had approved 0x2990A16D2C37163f26F86d7af219064Ba5CD5605, the contract the DeFiHackLabs proof of concept labels the AllowanceTarget, lost USDT, aUSDT and stETH in one transaction on 27 April 2026. The vulnerable contract, 0xa152751251a72f7d9e8a8998e9eadbefbf10e4f3, is unverified, as are the helper, the AllowanceTarget and a forwarder around it. Etherscan lists the same deployer, 0xB28813e8AaaFCD44036f08BE2d2c6576f6Ea6D21, for all four.

A forwarded request with no signature

0xa152 takes a user's input token through a helper at 0xfc40f02A22A78eaB1021A5aDaF5b3dd608da5837. The helper's spendFromUser(owner, token, amount) calls executeCall(token, data) on the AllowanceTarget, which runs transferFrom(owner, 0xa152, amount). 0xa152 then executes a caller-supplied list of calls and pays the output token to a caller-chosen recipient. The owner is whoever 0xa152 believes sent the request.

The attack contract never called 0xa152 directly. It sent eight requests (selector 0x69deb0b1) to 0x26bbc304699d31b5b3accfa83320a1a396da01f9, a forwarder from the same deployer, each with from set to a victim and to set to 0xa152. The forwarder appended from to the calldata in the ERC-2771 pattern, and 0xa152 passed that address straight to spendFromUser as owner. The requests carried no signature field, and the transaction contains no ecrecover call. Nothing tied from to the account that submitted it.

Every request named the attack contract, 0x99464c162b5816384e76f14912a87af9834c65db, as recipient. For the first victim the call list was a single Aave V2 withdraw, turning 85,744.811604 aUSDT into USDT inside 0xa152. The next seven were plain pulls: six of USDT, one of stETH. The attack contract sold the stETH for ETH on Curve, swapped the wrapped proceeds to USDT through Uniswap pools, and sent 229,030.9713 USDT to 0x224C940003dd0b8aA1A20e655ced0363D573fa46, the address that submitted the transaction.

The proof of concept impersonates 0xa152 with vm.prank and calls spendFromUser directly, so it reproduces the drain from the helper onward. The forwarder hop appears only on chain.

Figures and response

DeFiHackLabs records a loss of 229K USDT, and its proof of concept gives 229,030.97 USDT. That is the attacker's proceeds after the stETH was sold, measured in USDT, rather than the victims' balances in their own tokens. Defimon reported a loss of $230k and called it "yet another arbitrary call vulnerability" in an unverified contract. The largest victim, 0x0636D27Cc6AcE1462D175Ee72E617A3707ED7ACE, gave up 85,744.811604 aUSDT and 66,630.264947 USDT, per the token transfers on Etherscan.

On 8 May Defimon relayed an on-chain notice from the deployer address to 0xe68d0c829bec9ac3310f15db179406abc6decf48. It cites the attack transaction and offers a 10% white-hat bounty if the other 90% is returned.

The shape matches Nimiq, where an OpenGSN forwarder executed requests with from set to the victim without checking a signature, and standing approvals did the rest. Here too, a forwarder that recovered a signature from from and checked a nonce before appending it would have rejected all eight requests.