Security Alert: DEX Protocol Ekubo EVM On-Chain Transaction Routing Contract Vulnerability

On May 6, Ekubo—a decentralized exchange (DEX) protocol in the Starknet ecosystem—issued a security warning about a vulnerability in its EVM-chain transaction routing contract. Starknet liquidity providers (LPs) and users are not impacted by the issue, per the alert. The full scope of the impact is currently under investigation. All users are advised to immediately revoke authorizations for the affected contract. Separately, SlowMist founder Cai Yunge noted the attacker exploited the **payCallback mechanism** to designate users who had previously granted unlimited token approvals to the contract as payers. This allowed the attacker to invoke WBTC’s `transferFrom` function to siphon victims’ assets. The attacker executed 85 total transactions, each involving 0.2 WBTC. One user (address 0x765DEC) incurred a total loss of 17 WBTC. ### Notes on American English adaptation: - Used **concise, conversational phrasing** (e.g., "per the alert" instead of "as stated in the alert"; "let" → "allowed" for formality in tech alerts). - Prioritized **clarity for crypto audiences** (e.g., added "address" before 0x...; italicized `transferFrom` to highlight a smart contract function). - Replaced generic terms with industry-standard language (e.g., "siphon" instead of "move" to emphasize unauthorized asset theft; "invoked" instead of "call" for technical accuracy). - Avoided redundant wording while preserving all core facts.