Odos Protocol has been hacked for ~$50k on ETH and Base.
The root cause is arbitrary call vulnerability.

Attack tx: ​https://app.blocksec.com/explorer/tx/base/0xd10faa5b33ddb501b1dc6430896c966048271f2510ff9ed681dd6d510c5df9f6

Odos Protocol, a decentralized exchange (DEX) and routing aggregator, experienced a targeted exploit of its limit order contracts on Base that resulted in losses of roughly $50,000 across Ethereum and the Base Layer 2 network. The incident, analyzed by security firm QuillAudits, was traced to an arbitrary call vulnerability arising from insufficient input validation in the contract’s signature verification logic. The attacker deployed a malicious contract and then used it to interact with Odos’s limit order contract on Base, abusing the protocol’s flexible call pattern to bypass normal signature checks and drain user funds in a series of transactions. According to post-mortem analysis, the core issue lay in functions such as isValidSigImpl and isValidSignature, which allowed user-controlled data to dictate low-level calls to external contracts without adequate sanitization or restrictions. In particular, the exploit path involved arbitrary calls to a Create2 factory via unvalidated factoryCalldata, the use of a malicious ERC‑1271-compatible contract that always returned a “valid” signature, and interaction with the precompile contract at address 0x4 to further circumvent signature verification. This combination allowed the attacker to make Odos’s limit order system accept malicious orders as if they were properly signed, enabling unauthorized fund transfers. The case is significant as it highlights the risks of powerful, generic call abstractions in DeFi smart contracts—especially around signature verification, ERC‑1271 integrations, and counterfactual deployments using CREATE2. Security analysts have stressed the need for strict validation of user inputs, tighter control over which contracts can be used as signers, and careful handling of external calls and precompiles in order-routing and limit-order infrastructure. For other DeFi protocols, the Odos exploit is a cautionary example that even relatively small losses can reveal systemic design weaknesses in contract architectures that rely heavily on arbitrary call capabilities and flexible signature schemes.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• ByBit, ODOS, and BBX Hacked: $1.5B Drained via Social ... - Olympix (olympix.security)
• What Went Wrong With Odos Protocol? - QuillAudits (quillaudits.com)
• XRP vs XLM: ¿Cuál Podría Hacerte Millonario? | Wiki Cripto de WEEX (weex.com)
• El Resumen Diario | Boletín de Bankless (bankless.com)
• Perfil de Sanibtc | Binance Square (binance.com)

Explore the topic

• App
• Base Chain
• vulnerability
• Hacked