An access-control flaw (checks restricting who can call a function) in BonfireSwap’s router contract caused about $50,000 in losses, the SlowMist security team said. The transfer function did not verify that the caller matched the from address or had authorization to move assets from it. Attackers could therefore designate users who had previously authorized the router as from addresses, set themselves as to addresses, transfer the users’ tokens, and exchange them through a pool for the same token. SlowMist said 41 token holders were affected. The vulnerable contract address is 0x17e801e17cefc6334059189c178d4783830e03d3.