WINR Hack

Around $11k (roughly 293k WINR tokens) was stolen from users of WINR Protocol (JustBet), a gaming protocol on Arbitrum. Its MixedSwapRouter accepted a caller-supplied payer address in its Algebra swap callback and pulled tokens from that address with transferFrom, without checking that the caller was a legitimate pool. An attacker triggered the callback through a fake pool with the payer set to a wallet that had approved the router, spending that approval to drain its tokens. Anyone who approved the WINR MixedSwapRouter should revoke.

Затронутые пользователи остаются под угрозой до тех пор, пока не отзовут свои доступы, поэтому рекомендуется воспользоваться приведенной ниже проверкой эксплойтов Revoke.cash, чтобы убедиться, что вы в безопасности.