Leaderboard
1119All-time rank
C
CheckoutPool
Mar 16, 2026
$86K
Lost
$86K
Recovered
$0
Net loss
$86K
Unrecovered0% recovered
xyz's legacy CheckoutPool contract on Polygon exposed a bridge() function without access control or recipient binding, allowing attackers to redirect execution into trusted settlement paths and drain funds to attacker-controlled accounts.
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Polygon
Event timeline
- Mar 16, 2026Exploit executed — $86K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%