Incident case file
Sign in to watchGaslessReservoirEnabler Allowance Abuse Exploit
Incident date Sep 22, 2026Last updated Oct 8, 2026
2 views
ClosedPolygonAllowance / approval abuseCluster: GASLESS-POLY-2026-09
Estimated loss
$23K
Affected users
997
Group joining is coming soon.
Investigation
85%
Facts and investigation
Ledger
Attacker
0x46f54c1a86575679fc3d29666c1717e9786279aa
Funds moved to
Consolidated and deposited into a bridge on Polygon (bridge not publicly named by SlowMist)
Linked
Vulnerable contract: 0x9b58fdadc16e30fba313e044bf9e88689c3f163e. 997 token-holder addresses affected, including 0x2f785ef4f514f6b785ab93062e05cfcc937fac96. Root cause: GaslessReservoirEnabler's erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC20 transferFrom instructions to an authorized asset owner, allowing arbitrary callers to spend victims' existing allowances through whitelisted tokens.
Chronology
1 beatDisclosed by SlowMist on September 22, 2026 at 04:42 UTC via transaction 0x2e476745f0f546dbe4583359ea6258dfb4fababea08734f676df2e6006e1fdee, this exploit abused an authorization-binding flaw in GaslessReservoirEnabler to drain existing WETH and ZED token allowances from 997 separate wallet addresses that had previously approved the contract. Proceeds were consolidated and deposited into an unnamed bridge on Polygon. No further disclosure of the bridge's identity has been made as of the last verification pass.
Sources and coverage
Victim testimonies
No testimonies yet.
+ Add my testimony → (coming soon)