Base WETH allowance / unrestricted call ~$31k
623 WETH (~$31k) drained on Base after an unverified helper spent a victim’s existing WETH allowance. Flow: victim → unverified spender → fresh helper → attacker wallet; funds still sitting with the attacker at report time.
Victim publicly offered a white-hat split; no refund observed yet. Residual approve on a contract with an open external-call surface, not a named blue-chip vault. A near-identical attempt the next day only produced zero-value transfers.
Confirmed firm alert + Basescan tx.
369 take
Old unlimited (or leftover) approvals on unverified routers and “call anything” helpers are still a live drain path: even at $30k on L2s.
Pulse lesson: revoke stale allowances, never leave spend rights on sketchy helpers after you walk away from a UX, and treat unverified multicall-style contracts as hostile until proven otherwise.
Sources