The Red Village (Polygon): ~$80.7k via public upgrade path
21 Sep 2026 (Defimon public write-up 07 Oct): Defimon says a public routing function on The Red Village NFT game could upgrade one of its contracts to attacker code. FI. An on-chain bounty message appeared about two weeks later.
Late disclosure of a September incident. news.
369 take
Game contracts with public upgrade or routing helpers plus standing player approvals are a drain surface. Revoke approvals when you leave a game.
Prefer contracts that cannot swap their own implementation without a delay.
Sources