According to ChainCatcher, user @shoucccc posted on the X platform that the liquidity pool of Blast ecosystem project YOLO Games on Bazaar was stolen for $1.5 million. The root cause was that there was no permission check in the "exitPool" function, allowing anyone to impersonate a liquidity provider and drain the pool.
In response, SlowMist Chief Information Security Officer (CISO) 23pds said that the hackers have returned 90% of the funds.
Earlier news, Blast ecological game platform YOLO Games posted on the X platform at around 4 am today that the YOLO LBP sale ended early due to a security vulnerability reported in the Bazaar LBP smart contract. Users will no longer be able to participate in LBP. Any user who purchased and held rYOLO during the sale will receive an ETH refund based on the amount spent, and the incident will be sorted out in the next few days.