Avalanche Safe: Unlimited Approvals to an Unclaimed Address, ~$7.45M Front-Run

$7.45M, per Defimon. On-chain: most of it was sent back on 27 Oct; the ~42.5K WAVAX not returned matches the 42,500 WAVAX bounty.

Root cause: Per Defimon: the Safe kept unlimited WAVAX, USDC, WETH.e and BTC.b allowances to an address that holds the team's pool contract on other chains but was empty on Avalanche, where it is the address Safe's public CreateCall contract produces on its 13th deployment. An attacker deployed a sweeper there; an MEV bot copied and front-ran it.

Timeline, as sourced: Approvals granted 7 Mar 2026 (on-chain). Attack tx 26 Oct 12:56:14 UTC (per Snowscan); Defimon detection 13:00:23 UTC. Returns 27 Oct 09:39 to 09:46 UTC (on-chain).

Avalanche C-Chain, 26 Oct 2026. Victim operator: unnamed (Unknown); Defimon describes a trading team's 2-of-7 Safe holding trading inventory.

Per Defimon (post (opens in a new tab)): on 7 Mar 2026 the Safe granted unlimited WAVAX, USDC, WETH.e and BTC.b allowances to 0x3725bd4d…266155d (approval tx (opens in a new tab)). On Base, Arbitrum and Ethereum the team's pool contract lives at that address. On Avalanche it was empty: it is the address Safe's public CreateCall contract produces on its 13th deployment, and CreateCall had never been used there. The approvals were never revoked.

A fresh EOA deployed CreateCall, burned 12 deployments, and placed a sweeper at the approved address (attack tx, reverted (opens in a new tab)). An MEV bot copied and front-ran it in the same block (MEV tx (opens in a new tab)), taking 3.09M USDC, 350.4K WAVAX, 182 WETH.e and 10.79 BTC.b. Defimon puts the loss at $7.45M.

Per Defimon, the operator's signers on HyperEVM, Base, Robinhood Chain, BSC and Ethereum moved those Safes' funds to a fresh address from 13:48 UTC. The owners offered the bot a 42,500 WAVAX bounty (Defimon (opens in a new tab)).

Return (on-chain, checked 27 Oct via Routescan): on 27 Oct 09:39–09:46 UTC the bot address sent 3,090,122 USDC (tx (opens in a new tab)), 181 WETH.e (tx (opens in a new tab)), 10 BTC.b (tx (opens in a new tab)) and 307,834 WAVAX (tx (opens in a new tab)), plus small test/remainder transfers, to 0x35c6aa24…2807C, the return address named in the bot's on-chain message (Defimon (opens in a new tab)). The ~42.5K WAVAX not returned matches the bounty (Modeled: arithmetic, 350.4K − ~307.8K).

Pattern: an allowance to an address is an allowance to whoever can deploy there. Deterministic addresses are per chain, not global.