Gnosis Pay Reviews Security Incident: Vulnerability Caused by Signature Verification Logic Flaw, Now Fixed

Foresight News reported that Gnosis Pay released a review report on the June 1 security incident, disclosing that the root cause of the vulnerability was a flaw in the ERC-1271 signature verification logic within the Zodiac module: the system only read the contract's return result without checking whether the call had actually succeeded. Attackers exploited this by deploying a contract designed to intentionally fail but still return a "valid" indicator, thereby forging authorization and withdrawing funds from accounts they did not own. This vulnerability was introduced with version 3.4.0 of the Zodiac code in October 2023 and was fixed on June 5. According to the report, the attackers stole approximately 1.5 million US dollars, affecting 5,281 wallets, including about 641,000 US dollars in GNO, about 453,000 US dollars in EURe, and about 399,000 US dollars in USDC.e; an additional 300,000 US dollars is locked in inaccessible accounts, and the team is exploring recovery options. Gnosis Pay stated that they will expand their security team, introduce external audits, broaden the scope of smart contract audits, and have completed a comprehensive product rebuild (v2) to enhance security response capabilities.