Astroport

Neutron governance proposal 9 contained MsgUpdateAdmin messages that reassigned administration of Astroport contracts despite those contracts previously being administered by Astroport’s own governance contract. After the proposal passed, the attacker migrated Astroport Staking and six Astroport pair contracts to attacker-uploaded code containing a withdraw_all entry point and swept their balances.

The attack did not exploit Astroport’s swap or pool logic.