Security Alert: Ekubo Contract Exploited, Users Urged to Check Authorizations

Ekubo contracts have been maliciously exploited, according to Odaily. SlowMist founder Yu Jian posted on X platform, highlighting the issue. Users who previously authorized tokens to address 0x8CCB1ffD5C2aa6Bd926473425Dea4c8c15DE60fd are at risk. An example is user 0x765DEC, who granted unlimited authorization for WBTC 158 days ago. Attackers can designate authorized users as payers, using payCallback to execute WBTC transferFrom(victim, Ekubo Core, amount). The Ekubo Core (0xe0e0e08A6A4b9Dc7bD67BCB7aadE5cF48157d444) withdraw/pay process then transfers assets to the attacker. This operation occurred 85 times, each involving 0.2 WBTC, resulting in a total loss of 17 WBTC for user 0x765DEC. Users are advised to promptly install official alerts and check contract authorizations for the following addresses: 0x8ccb1ffd5c2aa6bd926473425dea4c8c15de60fd (V2), 0x4f168f17923435c999f5c8565acab52c2218edf2 (V3), and Arbitrum: 0xc93c4ad185ca48d66fefe80f906a67ef859fc47d (V3).