KiloEx releases summary of hacker incident: TrustedForwarder contract in smart contracts has vulnerabilities

On April 21st, KiloEx released a root cause analysis and post event summary of a hacking incident. The incident was caused by the TrustedForwarder contract in its smart contract inheriting the MinimalForwarderUpgradeable from OpenZeppelin but not rewriting the execute method, which allowed the function to be called arbitrarily. The attack occurred on April 14th from 18:52 to 19:40 (UTC), and the hacker carried out the attack by deploying attack contracts on multiple chains including opBNB, Base, BSC, Taiko, B2, and Manta. After negotiation, the hacker agreed to retain a 10% bounty and has returned all stolen assets (including USDT, USDC, ETH, BNB, WBTC, and DAI) to the multi signature wallet designated by KiloEx.