On January 23, 2025, a vulnerability in the ODOS Protocol’s OdosLimitOrderRouter contract was exploited, leading to the theft of approximately $50,000 on Ethereum and Base. The attack was caused by an arbitrary call vulnerability due to unverified user input combined with a pre-compiled contract to bypass the signature check.
Overview
Attacker Contract: https://basescan.org/address/0x22a7da241a39f189a8aec269a6f11a238b6086fc
Vulnerable Contract: https://basescan.org/address/0xb6333e994fd02a9255e794c177efbdeb1fe779c7
Transaction attack: https://basescan.org/tx/0xd10faa5b33ddb501b1dc6430896c966048271f2510ff9ed681dd6d510c5df9f6
Exploit Analysis
The attacker focuses on exploiting arbitrary call, which is used to deploy the ERC6492 contract. They can use the arbitrary call to steal tokens from this contract using ERC20.transfer but must bypass the signature check IERC1271Wallet(_signer).isValidSignature, which initially seems impossible because the _signer code length must be zero - meaning it cannot be executed. However, some special contracts do have zero code length yet can still execute commands: pre-compiled contracts.
The attacker used the 0x4 Identity pre-compiled contract, which is designed to copy data between memory portions. After stealing tokens using the arbitrary call, the attacker bypassed the signature check by using the 0x4 contract as _signer. The contract called IERC1271Wallet(0x4).isValidSignature without reverting, successfully completing the exploit.
Conclusion
When building your own project, does not trust any user input. Any parameter given must be carefully validated by the code. Calls to untrusted contracts can introduce several unexpected risks or errors. External calls can trigger malicious code, either within the target contract or across its ecosystem. Every external call should be treated as a potential security risk and must be processed with extreme caution.
Be very cautious when using contract code length, as this can introduce real issues with the contract’s constructor and pre-compiled contracts. Protocols using ERC-6492 should carefully check to mitigate similar risks.
Additionally, it is strongly recommended to conduct a security audit, not only for the first release version but also for any new features added in the future. Since the upgrading process can introduce various issues, it should also be thoroughly audited.
