Slice FundsModule on Base drained of about $41k via unverified release amounts from attacker-supplied contracts

Summary

On 2026-10-20 an attacker exploited a legacy release function in Slice's FundsModule (settlement contract) on Base and took about $41k in store earnings that had not yet been withdrawn. SlowMist and Defimon Alerts report that the function (selector 0x9d2edfac) credited whatever release amount a caller-selected source contract reported, without checking that the corresponding ETH or USDC had actually been received. Slice confirmed the incident, paused the protocol and fixed the vulnerability.

Affected

• Slice FundsModule proxy on Base (0x61bcd1ed11fc03c958a847a6687b1875f5eacaaf), implementation 0x8db3b6f51b594dc87b87a3a3b844de9c0d8d60b5 (unverified at the time, per Defimon Alerts)
• Fixed: Slice upgraded the module to a patched implementation (0xF9A0Fe077a9DB132ca617606390a0706f55aF87E per Defimon Alerts) and paused it about 1.5 hours after the attack

Impact

Per Defimon Alerts, the attacker first force-released the unclaimed sales revenue of about 70 Slice stores into the FundsModule, then passed in a fake "slicer" contract that reported the module's whole balance as its payout and withdrew it in the same call: 8.72 ETH and 19.8K USDC. SlowMist puts the loss at about $41k, Defimon at about $42k, and Slice at about $41k. Slice says most of the funds were its own or tied to past partner initiatives, fewer than 10 user stores were affected, and funds in users' wallets were never at risk. Exploitation is confirmed. Slice has offered the attacker a 10% white-hat bounty if 90% is returned by 2026-10-23 17:00 UTC.

Recommended actions

• Slice store owners: check the Slice dashboard for a notice and follow Slice's official instructions. The protocol is temporarily paused.
• Developers: never trust amounts returned by caller-supplied contracts in payout logic. Verify actual balance changes, and restrict release sources to known contracts.
• Exchanges and bridges: watch for inflows from the attacker address listed in the indicators.

Source & attribution

This 0xCERT advisory summarises the SlowMist TI alert (https://x.com/SlowMist_Team/status/2112746806585274454) and the Defimon Alerts analysis (https://x.com/DefimonAlerts/status/2112804669865042308), confirmed by Slice's own statement (https://x.com/slice__so/status/2112843976545796498) and summarised by Rekt Radar (https://www.rektradar.xyz/web3-daily-exploits-21-oct-2026-slice-41k-fundsmodule-morpho-2-3m-eip7702/). Details may change; refer to the original sources for the authoritative record.