SlowMist 警报：WAX 跨链桥 eth.token 合约因 max_fee 校验缺失损失约 9.05 万美元
🚨SlowMist TI Alert🚨 💸 @WAX_io Loss: ~$90.5K 🔍 Root Cause: WAX’s eth.token::withdraw failed to enforce max_fee ≥ 0 before debiting quantity + max_fee. Setting max_fee = -quantity reduced the debit to zero while preserving the full withdrawal amount. With the configured fee at zero, the fee check was skipped. On-chain records confirm that these requests generated bridge withdrawal logs and corresponding payouts on Solana and Ethereum. 📌 Attacker: WAX: http://fasdfas.al; Solana: 4H1piNZ8LsYhZGYhkbJDbPDSghxRj3HWxJqVz5dve8Q7; Ethereum: 0x01664E199991b2F3fe412c2DE5B9b7A0dcDc5070 📌 Victim: WAX Multi-Chain Bridge — Solana: 8cqv3kRg1ivwPNrGGrvJANXb6RPik6XEhnBzs18tPcKC; Ethereum: 0x24b22B031Ae1B5a6b09F9a0FD33613a40e0d70e6 📌 Vulnerable Contract: eth.token on WAX Powered by http://SlowMist.AI
SlowMist 指出 WAX 的 eth.token::withdraw 在扣除 quantity + max_fee 前未强制 max_fee ≥ 0，将 max_fee 设为 -quantity 可使扣款归零并保留全额提现，配置费率为零时费用检查被跳过。
来源：SlowMist_Team · x.com