Nimiq

Nimiq’s Polygon swap contracts served as OpenGSN forwarders while relying on their own preRelayedCall path to authenticate requests rather than independently verifying the user’s signature inside execute(). An attacker registered an EIP-7702 EOA as an OpenGSN relay manager, relay worker and permissive paymaster, then selected Nimiq’s HTLC handlers as the forwarders.

This allowed forged open() requests purportedly originating from a partner liquidity wallet to reach the handlers without the expected signature validation. e, with the attacker-controlled contract as recipient, and subsequently redeemed by the attacker.