Slice exploit: fake slicer drained unclaimed earnings

About $41k, per Slice. Defimon: $42K (8.72 ETH and 19.8K USDC).

Root cause: Per Defimon: FundsModule's release function called any caller-supplied 'slicer' address and credited the amount it reported, without verifying it was a real Slicer or that funds had arrived. Per Slice: 'a vulnerability in a legacy function of Slice's settlement contract.'

Timeline, as sourced: Exploit tx 20 Oct 2026 18:39:51 UTC (on-chain); Defimon alert 21 Oct 07:14 UTC; Slice statement 21 Oct 09:50 UTC.

On 20 October 2026 an attacker took unwithdrawn store earnings from Slice, a commerce protocol on Base. Slice said (opens in a new tab) the exploiter used a vulnerability in a legacy function of its settlement contract to take about $41k, that most of the funds were Slice's or tied to past partner initiatives, and that fewer than 10 user stores were affected. According to Defimon (opens in a new tab), the FundsModule's release function called any address passed in as a slicer and credited whatever payout it reported, without checking that it was a real Slicer or that funds had arrived. The attacker first force-released the unclaimed revenue of about 70 stores into the module, then used a fake slicer to withdraw the module's balance, 8.72 ETH and 19.8K USDC, Defimon says (transaction (opens in a new tab)). Slice says it paused the contracts and fixed the vulnerability within an hour of being alerted, and offered the exploiter a 10% bounty.