Base Chain: 16.623 WETH Drained via Unverified Contract

Base Chain saw 16.623 $WETH drained when an attacker triggered an unverified contract’s unrestricted external call to invoke WETH’s transferFrom function via selector 0x42be3129. The victim had previously granted approval, so the transfer executed without any new signature from the owner and moved the full amount through a fresh helper wallet straight to the attacker at 0xbdce6bdd52baceadd1fc91bf01f3bc6ab24df17a. The stolen WETH remains untouched. A follow-up attempt the next day failed to extract value. The victim later offered a white-hat bounty for 9 WETH return, yet no funds have moved. This Base chain WETH exploit highlights persistent unverified contract attack risks and WETH allowance theft vectors in DeFi approvals.