KiloEx Releases Hack Summary: Vulnerability in TrustedForwarder Contract in Smart Contracts

On April 21, KiloEx released the root cause analysis and post-event summary of the hacking incident. The cause of the incident was that the TrustedForwarder contract in its smart contract inherited the OpenZeppelin MinimalForwarderUpgradeable but did not override the execute method, resulting in the function being arbitrarily called.
The attack took place between 18:52 and 19:40 (UTC) on April 14. The hackers carried out the attack by deploying attack contracts on multiple chains such as opBNB, Base, BSC, Taiko, B2 and Manta. After negotiation, the hackers agreed to keep the 10% bounty and have returned all stolen assets (including USDT, USDC, ETH, BNB, WBTC and DAI) to a multi-signature wallet designated by KiloEx.