Wu learned that the security company Blockaid stated that it detected an exploit in a custom extension contract of Ekubo Protocol on Ethereum, which has currently caused approximately $1.4 million in losses. Blockaid said that the vulnerability stems from the extension contract not verifying whether the payer is the lock initiator or an authorized payer when executing payment callbacks. Attackers can exploit this to transfer funds from users who have granted ERC-20 allowances to the contract via transferFrom; currently, only users who have authorized this v2 contract as a spender are at risk.