WUSD.fi / GLOVE — Incentive Sybil Abuse on _englove Reward Path

Timeline: On 25 May 2026 at 06:07:59 UTC (Ethereum block 25170426), an attacker exploited the WUSD._englove reward path, which let any fresh msg.sender wrapping at least 100 WUSD while holding fewer than 2 GLOVE receive up to 2 GLOVE via Glove.mintCreditless, with no Sybil resistance. Using EIP-7702 helper contracts and a Morpho USDT flash loan (~81.8M USDT), the attacker ran repeated wrap/unwrap cycles with fresh addresses to harvest GLOVE, then dumped it into the Uniswap V3 GLO-USDC and GLO-USDT pools, extracting about 11,702 USDC and 8,079 USDT (~$200K). The exploiter EOA (0x88329A09...5a57f8) was a freshly created wallet exhibiting classic disposable-exploit behaviour (50 transactions in one hour, 41 unknown-contract interactions, ~99.79% counterparty concentration, per KaelAi). ExVulSec flagged the incident at ~09:54 UTC on 25 May, and PeckShield confirmed at ~13:59 UTC that the attacker had swapped the proceeds for ~98 ETH and Shielded them into Railgun (~$207K), tx 0x98a5bfe6...ae8f70e. The headline loss figure of $200K (SlowMist / ExVulSec) is used; PeckShield's ~$207K cash-out figure is recorded under funds moved. Recovery: 0%.