WINR Hack

Around $11k (roughly 293k WINR tokens) was stolen from users of WINR Protocol (JustBet), a gaming protocol on Arbitrum. Its MixedSwapRouter accepted a caller-supplied payer address in its Algebra swap callback and pulled tokens from that address with transferFrom, without checking that the caller was a legitimate pool. An attacker triggered the callback through a fake pool with the payer set to a wallet that had approved the router, spending that approval to drain its tokens. Anyone who approved the WINR MixedSwapRouter should revoke.

影響を受けたユーザーは、承認を取り消さない限りリスクにさらされ続けるため、以下の Revoke.cash エクスプロイトチェッカーを使用して、ご自身が安全であることを確認することをお勧めします。