CyberHeartrobe👨‍💻

Hey @ponsdotfamily, quick heads up on an Exploit in your platform, this needs to be addressed immediately as your users are being drained in real time When users trade on your platform, they're approving their tokens to Multicall3 instead of a dedicated DEX contract Multicall3 is a public contract. anyone can call it with arbitrary calldata. that means between swaps, anyone can construct a transaction that drains every wallet that approved tokens to that address Every user who has traded through your frontend and approved tokens to Multicall3 is currently at risk. their approved balances can be taken by anyone who builds the right calldata This isn't theoretical, this is an open exploit waiting to happen. every wallet with an active approval is vulnerable right now • users: if you've traded on pons, revoke your approvals to Multicall3 immediately. use revoke.cash or etherscan's token approval checker • pons team: please fix the approval flow to route through a dedicated contract, not a public multicall. and alert your users to revoke existing approvals This isn't fud. this is a critical security issue