-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0351
============================================================

Advisory-ID:  0xCERT-2026-0351
Severity:     Medium
Published:    2026-11-13T18:23:10.000Z
Updated:      2026-11-14T20:43:08.923Z
Chains:       Arbitrum, Base
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0351

Title: Pool Party snapshot contract flaw exploited to drain 15 pools on Arbitrum and Base for about $215k

Summary
- -------
On 13 Nov 2026 an attacker exploited a flaw in Pool Party's per-pool snapshot contract to rewrite their recorded position and drain 15 pools (12 on Arbitrum, 3 on Base), about $215k. Pool Party says the fix is live on all chains; the attacker address is listed as an indicator.

Details
- -------
Summary
Pool Party reported that on 13 November 2026, between 01:34 and 03:38 UTC, an attacker drained 15 pools: 12 on Arbitrum and 3 on Base, for a total loss of approximately $215k. Each pool has a snapshot contract that records each user's position; the attacker found a vulnerability in this contract, changed their recorded position, deposited 10 USDC and withdrew all funds from the pool. Pools on Polygon and Robinhood Chain were not affected.

Affected
- - Pool Party pools and their snapshot contracts on Arbitrum (12 pools) and Base (3 pools)
- - Fixed: per Pool Party, the snapshot contract vulnerability has been corrected on all 4 chains (Arbitrum, Base, Polygon, Robinhood Chain)

Impact
Exploitation is confirmed. Per Pool Party, the attacker has already converted the funds to XMR. Pool Party is tracking the funds with security teams and has reported the incident to law enforcement and the exchanges involved. A full post-mortem and a plan for affected users have been promised but not yet published.

Recommended actions
- - Pool Party depositors: follow Pool Party's official X account and Discord for the post-mortem and the affected-user plan; ignore unofficial "refund" or "claim" links and DMs.
- - Exchanges and wallets: screen for the attacker address listed in the indicators.
- - Developers of similar vault/fund contracts: review any contract that records user positions for unauthorized write paths.

Source & attribution
This 0xCERT advisory summarises Pool Party's incident thread (https://x.com/PoolParty_xyz/status/2121307902430359906), corroborated by SlowMist Hacked (https://hacked.slowmist.io/). The attacker address is quoted verbatim from Pool Party's thread. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/PoolParty_xyz/status/2121307902430359906
- - https://x.com/PoolParty_xyz/status/2121307910240354688
- - https://hacked.slowmist.io/

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0Fgmr4/W0JEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmcWF5XWnILBcIjANkvb+KzZG2ru9JVkODWK0Rqx
TdRqsBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADISAD+JuxAybt4UVRbyPfS
9tPlFjcbCA2Bf6bxP+xi4nm2feYBAJXHRg+QIeO0ZkiQRX3dJjx9mwV1Avzq
DsGFTfBYFnMA
=yBRo
-----END PGP SIGNATURE-----