Argent-style wallet exploit: recovery wrap and replay

~$59.8k, per SlowMist.

Root cause: Per SlowMist: an unrestricted recovery-period setter (0x254a2e49) let the recovery deadline wrap into the past, and the execution module accepted the same signed 0xaacaaf88 payload repeatedly.

Timeline, as sourced: Exploit txs 19 Oct 2026 09:42:35 and 09:43:35 UTC (on-chain); SlowMist alert 12:21 UTC.

On 19 October 2026 an attacker took about $59.8k from two wallets in an Argent-style smart-wallet system on Ethereum (first (opens in a new tab) and second (opens in a new tab) transactions). According to SlowMist (opens in a new tab), the recovery module's unrestricted 0x254a2e49 setter accepted a recovery period crafted so that the computed deadline wrapped to a timestamp in the past, letting a recovery backed by a valid guardian signature finalize in the same transaction and change the wallet owner. Separately, the execution module did not reject reuse of an identical signed 0xaacaaf88 payload, which succeeded 19 times in one transaction and nine in the other; SlowMist says the attacker used the repeats to trade around a low-liquidity MARK/WETH pool. SlowMist does not name the wallet deployment.