Startale ERC-7579 Transient Storage Initialization Flaw — $2,876

On September 16, 2026, an attacker exploited a flaw in Startale's ERC-7579 smart account infrastructure. An initialization flag stored in transient storage persisted across the entire transaction rather than being properly scoped, allowing an attacker to trigger re-initialization with a malicious bootstrap configuration. This let the attacker drain approximately 330 counterfactual (pre-funded but not yet deployed) smart accounts for a total of $2,876. The underlying Soneium network — co-founded by Startale Group and Sony Group — was not itself affected.