Aurellion Suffers Attack Leading to Loss of USDC

Aurellion has been attacked, resulting in a loss of approximately 455,003 USDC, according to Odaily. The security breach was traced to a vulnerability in the SafeOwnable Facet's initialize(address) function, which lacked adequate protection. The Diamond contract failed to update the _initialized version slot correctly when setting the owner, allowing the attacker to reinitialize the contract and override owner permissions. The attacker subsequently used the diamondCut function to inject a malicious Facet and transferred authorized users' USDC assets through a malicious pullERC20 function, completing the theft. The affected contract address is 0x0adc63e71b035d5c7fdb1b4593999fa1f296f1b2, with the vulnerability Facet located at 0x3ca79c1cf29b8d19f7c643bb6e6bc9c49762e70f. The attacker's address is 0x9f49591a3bf95b49cd8d9477b4481ce9da68d5ca. Currently, the attacker has seized ownership of the Diamond contract and transferred USDC from several authorized addresses, including 0x2e933518..., 0xa90714a1..., and 0xeced2d37....