Daily Brief

Web3 Daily Exploits — 9 Sep 2026: Order Factory ~24.7 ETH + Enso Deprecated Vault ~5.6 ETH

Two confirmed Ethereum drains in the last 24 hours: an unnamed order-factory access-control miss took ~24.7 ETH, and leftover funds in a deprecated Enso DPI strategy vault were pulled for ~5.6 ETH. No new eight-figure protocol loss in this window.

Jacobo Avariento

Jacobo Avariento

— 5 min read
Web3 Daily Exploits — 9 Sep 2026: Order Factory ~24.7 ETH + Enso Deprecated Vault ~5.6 ETH

The last 24 hours were a small-drain window after yesterday’s Liquid remainder story. SlowMist published two fresh Ethereum TI alerts: an unnamed order-factory / account-system pair lost approximately 24.7 ETH to a missing caller check on createOrderForBuyer, and leftover liquidity in a long-deprecated Enso Finance DPI strategy vault was extracted for about 5.6 ETH through a broken TWAP window. Combined live loss on newly confirmed items is roughly $75k at ~$2,490/ETH. The Liquid Federation still holds an unpaid 598.5 BTC gap from the 6 Sep peg-out; that remainder is unchanged and is not re-scored as a new incident.

Monitors checked for this cutoff: DefimonAlerts, CertiKAlert, Phalcon, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi, and rekt.news. Phalcon, PeckShield, BlockSec, Cyvers, and rekt.news had no new first-report protocol drains in the window. ZachXBT posted on centralized-platform breach handling and an older investigation, not a fresh on-chain exploit. Lookonchain and Immunefi published whale and bounty-leaderboard items only. All dollar figures below are amounts still outside the affected contracts unless a return transaction is cited.

Unnamed order factory / account system — ~24.7 ETH (Ethereum) — Confirmed

What happened: SlowMist flagged a ~24.7 ETH drain from a whitelisted account system driven by an order factory. Anyone could invoke the factory’s createOrderForBuyer path against an arbitrary active buyer. The factory moved that buyer’s full ETH balance into a newly created order proxy; proxy initialization then wrote the attacker contract into a privileged storage slot so a later abort / finish path paid the attacker.

Protocol / chain / asset: Unnamed order factory plus account system on Ethereum. Asset taken: ETH. No public project name, docs site, or token ticker was attached to the SlowMist alert.

Loss: ~24.70 ETH internally credited to the attacker EOA (Etherscan balance on that address printed 24.751 ETH / ~$61.6k at the contemporaneous ~$2,490 print). No recovery or project statement identified at time of writing.

Attack type: Missing access control on order creation. The factory checked only that a buyer request was marked active. It did not require msg.sender == buyer, a buyer signature, a nonce, or any authorization over the attacker-supplied seller.

Technical details: SlowMist’s selector for the factory entry is 0xbde886fc (createOrderForBuyer). After the factory pulled ETH from the account system into a fresh proxy, order initialization wrote the attacker contract into storage slot 27. That write satisfied the later abort check, so the proxy’s ETH could be taken in full. On-chain, the attacker EOA received 24.703408 ETH via an internal transfer on a successful finish() transaction dated 8 Sep 2026 15:48:23 UTC (block 25933639). Related calls from the same EOA in the same window include several 0xc3ea1f13 invocations, a run call, and a contract-creation transaction that pulled a small ETH amount through a RAILGUN Relay Adapt internal transfer — consistent with a scripted multi-step drain rather than a single swap.

Explorer links:

Status: Confirmed by SlowMist and visible on Ethereum mainnet. Funds sit on the attacker EOA. No public recovery.

Sources: https://x.com/SlowMist_Team/status/2097511755220242515

Enso Finance DPI strategy vault — ~5.6 ETH (Ethereum) — Confirmed / deprecated contracts

What happened: SlowMist reported an approximately 5.6 ETH loss from an Enso Finance / DPI strategy vault. An oracle valuation bug minted excess shares against a manipulated price, and those shares were redeemed for profit in the same flow. Enso replied that the affected contracts were deprecated more than four years ago, that users had already been told to withdraw, and that current Enso infrastructure does not use them. SlowMist later quoted that confirmation.

Protocol / chain / asset: Legacy Enso Finance DPI strategy path on Ethereum. Assets in the described flow: WETH and FARM. Current production Enso stack is out of scope for this loss figure.

Loss: ~5.6 ETH (~$14k at ~$2,490/ETH). Treat as live loss from the deprecated vault, not from Enso’s current audited deployment. No on-chain return identified.

Attack type: Oracle / TWAP window error plus thin Uniswap v3 liquidity. Registry fee reused as secondsAgo, collapsing the observation window toward spot.

Technical details: SlowMist’s read of Controller.deposit(): EnsoOracle.estimateStrategy() is called before and after the user token transfer, and shares are minted on the difference (mint = amountAdded * totalSupply / valueBefore). Valuation walks EnsoOracle → ItemEstimator → ProtocolOracle.consult() and prices via Uniswap v3 pool.observe(). Because the registry fee field is reused as the TWAP lookback, the window is near-spot. There is no separate TWAP consistency or price-range check. In the reported transaction the attacker swapped 0.683 WETH for 268.42 FARM on Uniswap v2 while the imbalanced v3 pool valued that FARM stack at 6.3 WETH (about 9.2×). Excess shares were minted at that print and redeemed. Addresses named by SlowMist: attacker 0x3196398321D77a2511d369DCB6eCa9d2aD87b73A, controller implementation 0xd8D22509C1fe47516D8F82A28CFd728111F57Ef1, oracle 0xAb7505eB360cE0D63e8E88f7853677EcD5537DC0. The attacker EOA later routed proceeds through SushiSwap RedSnwapper, Kyber Meta Aggregation Router v2, and 1inch Aggregation Router V6 (blocks around 25934849–25934902).

Explorer links:

Status: Confirmed drain of leftover funds in deprecated contracts. Project says current infra is separate and audited. Users who never exited the old vaults remain the residual risk surface.

Sources: https://x.com/SlowMist_Team/status/2097602957311455640, https://x.com/EnsoBuild/status/2097616808085692692, https://x.com/SlowMist_Team/status/2097622875616510141

Also noted

  • Liquid Network (UPDATE, not re-scored): 3,400 BTC remains returned; ~598.5 BTC (~$47M at yesterday’s print) is still held by the self-described whitehats. CertiK’s incident write-up recirculated in the window. No additional return transaction was confirmed after the 8 Sep brief. Sources: https://x.com/CertiKAlert/status/2097287047014752449, https://www.certik.com/blog/liquid-network-incident-analysis, https://x.com/GoPlusSecurity/status/2097166847288496599.
  • Balancer DAO recovery notice: Defimon relayed an on-chain message to a wallet tied to a Balancer V1 exploit dated 6 Sep 2026, offering a private bounty via Blockscan / SEAL911 / Hypernative with a 15 Sep 21:00 UTC deadline. The underlying 6 Sep event was not a first-report item in this cutoff; treat as a recovery thread. Source: https://x.com/DefimonAlerts/status/2097376843829592574.
  • Stake DAO vsdCRV (May 2026) legal deadline: On-chain final offer to return 37.029 ETH to 0x5DA07af8913A4EAf09E5F569c20138b658906c17 by 15 Sep 2026 18:00 UTC. Old incident. Source: https://x.com/DefimonAlerts/status/2097306031856537860.
  • WealthManagementV2 26,414 USDT and unnamed BNB router ~62.28 BNB: Already scored in the 8 Sep brief. No material new loss figure.
  • GoPlus $LAPTOP phishing / copycat-token warning: Airdrop impersonation sites and same-ticker clones. Social-engineering risk, not a protocol drain. Source: https://x.com/GoPlusSecurity/status/2097632697216831784.
  • MistTrack / SlowMist noted Tether froze ~39.3M USDT across 10 TRON addresses linked to Xinbi Guarantee. Compliance freeze, not a smart-contract exploit.
  • ZachXBT, CyversAlerts, PeckShieldAlert, Phalcon, BlockSecTeam: no new qualifying protocol-exploit first reports in the cutoff after the items above.

Sources & references

Editor’s note: Card live-loss is this window’s two confirmed Ethereum drains only (~24.7 + ~5.6 ETH ≈ $75k). Liquid’s unpaid 598.5 BTC is carried as an update, not a new incident. Whitehat and bounty claims are recorded as claims. No how-to or exploit reproduction steps. Verify explorers and official channels before acting on any alert.

Read more