On July 30, an attacker drained 16.623 WETH (~$30.6K) on Base by exploiting a closed-source contract. Both the vulnerable contract and the attacker's helper were unverified, so I reconstructed both contracts directly from their EVM bytecode. The root cause was an unrestricted external call inside the contract's “universal swap” function: aggregator.call(data) The caller controlled both aggregator and data, with no allowlist or validation of the target call. The attacker's helper supplied: • aggregator = WETH • amountIn = 0 • tokenIn = tokenOut = WETH • data = WETH.transferFrom(victim, executor, 16.623 WETH) Because the victim had an existing WETH allowance to the vulnerable executor, the call pulled the WETH into the contract. The executor then interpreted its new WETH balance as swap output and transferred the entire balance to the attacker's helper, which immediately forwarded it to the beneficiary. The helper was deployed and the drain executed atomically in the same transaction. Full decompiled contracts and exploit transaction in the first reply.

EVM decompilation sits in an interesting middle ground. Automated tools can recover a surprising amount, but the hardest parts of the problem still require significant human effort and iterative refinement. Here's a clear look at where the difficulties actually lie.