Access-Control and Timing Bugs Drive a Fresh Round of On-Chain Exploits

A DeFiHackLabs proof-of-concept shows an unprotected arbitrary-call forwarder drained on Base, alongside a time-of-check-to-time-of-use flaw in Index Coop's issuance contract.

While the Coldcard entropy failure dominates this week's losses, the smart-contract layer produced its own steady stream of smaller incidents, each a clear example of a familiar failure mode. The security-research collective DeFiHackLabs pu…