Startale

Attacker exploited Startale ERC-7579 smart-account initialization logic to take control of pre-funded counterfactual accounts as they were deployed. The initializeAccount(bytes) permitted an attacker-controlled bootstrap to execute via delegatecall, while an initialization authorization flag stored with transient storage remained set for the entire transaction.

The attacker could therefore deploy a victim’s pre-funded account and reinitialize it again in the same transaction with a malicious bootstrap, allowing its assets to be swept.