Slice Protocol Hack

On October 21, 2026, onchain commerce protocol Slice on Base was exploited for approximately $41,000 USD.

The vulnerability exploited by the attacker resided in the FundsModule contract's handling of external source contracts, where the 0x9d2edfac function accepted release amounts returned by user-specified contracts without verifying asset transfers. To exploit this, the attacker deployed two custom source contracts that reported nonzero asset release amounts while transferring zero assets to the protocol. With the execution flag set to true, the contract utilized these unbacked, fraudulent figures to compute immediate withdrawals from the shared pooled reserves.

This logic flaw enabled the attacker to drain approximately $41,000 in pooled ETH and USDC reserves directly to their EOA (0xc34572eb…8c892f) in a single transaction (0x02b039a6…8d790a).

Attack Transaction Hash: 0x02b039a6…8d790a

Attacker Address: 0xc34572eb…8c892f

Victim (FundsModule Proxy): 0x61bcd1ed…eacaaf

Vulnerable Implementation: 0x8db3b6f5…8d60b5