Hack history / 2026 / Hack or exploit
GaslessReservoirEnabler
Hack or exploit on Sep 21, 2026 · Smart Contract Vulnerability
SOURCES AGREE ON DATE AND LOSS · 2 SOURCES
Lost
$23K
dollars at the time
Returned
none listed
as the sources state it
Rank
#2,101
among thefts by dollars lost
What happened
The Polygon contract GaslessReservoirEnabler had an authorization flaw: erc20WithTransfersAndExecute → _executeInternal checked module addresses but did not bind ERC-20 transferFrom calls to an authorized asset owner. An attacker could therefore spend victims’ existing allowances on whitelisted tokens (WETH and ZED). About 997 token-holder addresses were drained for roughly $23,000. The proceeds were consolidated and deposited into a bridge on Polygon.
Details
- Date
- Sep 21, 2026
- Kind
- Hack or exploit
- Method
- Smart Contract Vulnerability
- How in
- Bridge and cross-chain
- Target
- not stated
- Chains
- Polygon
Reported by
Related incidents
RsETHSafeModule 2026 · Hack or exploit · $7.7M
Third-party Gnosis Safe Module (SquidRouterModule) 2026 · Hack or exploit · $3.2M
Haedal Vault 2026 · Hack or exploit · $915K
NEM（NemTokenV2） 2026 · Hack or exploit · $822K
Butter Bridge 2026 · Hack or exploit · $180K
Third-party Gnosis Safe Module (SquidRouterModule) 2026 · Hack or exploit · $3.2M
Haedal Vault 2026 · Hack or exploit · $915K
NEM（NemTokenV2） 2026 · Hack or exploit · $822K
Butter Bridge 2026 · Hack or exploit · $180K
Cite this page
SwanBluechip, "GaslessReservoirEnabler hack, Sep 21, 2026: $23K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht65455148cf/ (data as of 2026-10-31).