Slice (Base): ≈$41K of store revenue drained from FundsModule
Update
Slice says most of the $41K was its own; under 10 stores hit
21 Oct: Slice says a legacy function in its settlement contract took about $41K of store earnings that had not been withdrawn. Most of that was Slice's or tied to past partner work.
Fewer than 10 user stores were affected. Slice says user wallets were never at risk, the contracts were paused and fixed within an hour, and a restart is expected in 24 to 48 hours.
The bounty offer stays open until 23 Oct 17:00 UTC.
20-21 Oct 2026: SlowMist, Defimon, and TenArmor report about $41K to $42K of store owners' unclaimed revenue drained from Slice's FundsModule on Base. Firms say the module trusted payout amounts reported by caller-chosen contracts.
5 hours later and posted an on-chain offer: return 90% by 23 Oct 17:00 UTC and keep 10% as a bounty. The vulnerable implementation was unverified on the explorer. Research snapshot from SlowMist, Defimon, and TenArmor.
369 take
Credit only tokens the contract measured arriving. A caller-chosen contract reporting its own payout is the same family as this week's unbacked-mint notes. Slice already paused the module.
Sources