Ekubo Protocol extension contract attacked, with losses of approximately $1.4 million

According to monitoring by Blockaid, Ekubo Protocol's expansion contract on Ethereum was attacked, resulting in a loss of approximately $1.4 million. The attack stemmed from the contract's IPayer.pay callback function not verifying the identity of the payer. The attacker exploited users' ERC-20 approvals to the contract and stole assets via the Core router. Users who have authorized this V2 contract are at risk, while Ekubo users themselves are not affected.