Socket Protocol Suffers Call Injection Attack, Leading to Stolen User Funds

According to Foresight News, Beosin's EagleEye monitoring system has detected a call injection attack on the Socket protocol, resulting in a significant amount of authorized user funds being stolen. The attack is primarily due to an unsafe call in the performAction function of the Socket contract. The attacker constructed calldata, called the transferfrom function of any token, and transferred the tokens authorized by other users to the attacker's address. The stolen funds have been exchanged for 1,137 Ethereum, which is approximately $2.91 million.