Reflexer Finance Exploit: How a Permissions Check Flaw Led to Theft of 5.9 ETH in Collateral

BitcoinWorld

Reflexer Finance Exploit: How a Permissions Check Flaw Led to Theft of 5.9 ETH in Collateral

Blockchain security firm SlowMist has reported that a permissions-check vulnerability in Reflexer Finance’s GEB stablecoin system appears to have been exploited, resulting in the theft of collateral worth approximately 5.9436 ETH. The incident highlights the persistent risks associated with smart contract interactions and the importance of rigorous security audits in decentralized finance (DeFi).

How the Exploit Occurred

According to SlowMist, the issue arose when a user directly called the quitSystem function to close a collateral position, also known as a SAFE, instead of routing the transaction through the required DSProxy. This misstep incorrectly recorded the SAFE’s owner as the GebProxyActions contract, rather than the user’s own address. The attacker, recognizing the access-control flaw, was able to bypass the SAFE’s ownership check and withdraw the collateral to their own address.

This exploit underscores a common yet critical pitfall in DeFi: the assumption that users will always interact with smart contracts through the intended intermediary. When that assumption fails, the resulting state changes can create unexpected vulnerabilities.