Lumi Finance suffers attack, with losses of approximately $270,000

According to ChainCatcher, GoPlus analysis reports that Lumi Finance on Arbitrum was attacked on July 13, resulting in a loss of approximately $270,000.

The vulnerability originated from a logical flaw in the validateUserOp function of the Sodium smart account contract (ERC-4337) — during signature verification with _validateSignature, the isValidSignatureNow function passed the signer parameter as the attacker’s address. After an error in calling ECDSA.tryRecover was not reverted, it proceeded to call the isValidSignature function in the attack contract and successfully passed verification. The attacker exploited this flaw to perform Token approve operations during UserOperation verification, obtaining ERC20 token approval permissions from multiple smart accounts without authorization from the payers.