SlowMist 警报：TranchePool 结算逻辑漏洞致约 101.3 万 USDC 被二次提取

🚨 SlowMist TI Alert 🚨 💸 Loss: ~1.013M USDC from a TranchePool reportedly associated with @ValinorDigital, Oatfi, and @fence_finance 🔍 Root Cause: At the UTC day rollover, the victim’s settlement logic treated a scheduled principal payment as received and subtracted it from the tranche’s recorded outstanding principal, despite no USDC repayment. The draw function (0x8e27c105) then checked the requested amount against funded principal − outstanding principal. That artificially restored 1.013M USDC of draw capacity, allowing the attacker to draw the same amount a second time with identical calldata. 📌 Attacker: 0x6ff1c3ffa622e1062168f3497a275be9cc2b1246 📌 Vulnerable Contract: 0xe25cb545bdd47a8ec2d08001cb5661b00d47621a Powered by http://SlowMist.AI Tx: https://snowscan.xyz/tx/0x19ab145e7f771549ca2f1da4b1768d7f728834015b2480ddb5be19c9769899fd https://snowscan.xyz/tx/0x3f6b23292a2e9c2956c7ac56d0b1f79b0271b49edec2156d2675ddf1de058c77

来源：SlowMist_Team · x.com