SlowMist detected a malicious transaction showing that delegated code and an unchecked batch execution path in a vulnerable EIP-7702 account enabled attackers to drain QNT from a reserve pool.
A QNT reserve pool was exploited for 1,988.5 QNT, valued at about 54.93 ETH, after attackers abused what SlowMist described as a vulnerable EIP-7702 account structure. According to SlowMist, an EOA admin delegated code to BatchExecutor, which then authorized a permissionless BatchCall contract with no access checks. Attackers used the unchecked execution path to drain tokens from the reserve pool. The incident highlights how delegation-based account setups and missing authorization controls in batch execution logic can enable unauthorized fund transfers.