Odaily Planet Daily reports that SlowMist has issued a security alert stating that Aurellion was attacked, resulting in a loss of approximately 455,003 USDC (about $455,000).
Analysis reveals that the vulnerability stems from the lack of proper protection in the initialize(address) function of the SafeOwnable Facet. Since the Diamond contract does not use the initialize path when setting the owner, the _initialized storage slot is not properly updated, allowing an attacker to reinitialize the contract and overwrite the owner permissions.
Subsequently, the attacker called diamondCut to inject a malicious Facet and transferred the authorized users' USDC assets through the malicious pullERC20 function, ultimately completing the theft of funds.
The related addresses are as follows:
Compromised contract: 0x0adc63e71b035d5c7fdb1b4593999fa1f296f1b2
Vulnerability Facet: 0x3ca79c1cf29b8d19f7c643bb6e6bc9c49762e70f
Attacker address: 0x9f49591a3bf95b49cd8d9477b4481ce9da68d5ca
Currently, attackers have taken ownership of the Diamond contract and have transferred USDC from multiple authorized addresses, including 0x2e933518..., 0xa90714a1..., and 0xeced2d37...