Ekubo Protocol v2 Custom Extension Contract Hit by Ongoing Exploit; Losses Total $1.4M

ChainCatcher reports that security firm Blockaid (@blockaid_) has flagged an ongoing attack targeting a v2 custom extension contract of Ekubo Protocol on Ethereum, with losses estimated at about $1.4 million. Blockaid said the issue stems from the extension's IPayer.pay callback, which does not properly validate where its parameters come from. As a result, attackers can set the payer, token, and amount values and trigger arbitrary transfers of tokens that have been approved. The core Ekubo protocol is not affected. Risk is concentrated among users who previously approved this v2 contract as a token spender. Blockaid urges impacted users to revoke those approvals immediately.