Ekubo Protocol Suffers $1.4 Million Loss in Ethereum Contract Attack

Ekubo Protocol's v2 custom extension contract on Ethereum is under attack, resulting in a loss of approximately $1.4 million. According to ChainCatcher, security firm Blockaid has identified the root cause as a vulnerability in the IPayer.pay callback, which lacks effective restrictions on parameter sources. This flaw allows attackers to manipulate the payer, token, and amount parameters, enabling unauthorized transfers of approved tokens. While Ekubo's core protocol users remain unaffected, those who have authorized the v2 contract as a token spender face direct risks. Blockaid advises these users to revoke their authorizations immediately.