# Access-Control and Timing Bugs Drive a Fresh Round of On-Chain Exploits

A DeFiHackLabs proof-of-concept shows an unprotected arbitrary-call forwarder drained on Base, alongside a time-of-check-to-time-of-use flaw in Index Coop's issuance contract.

- Published: 2026-08-03T05:28:57.944Z
- Canonical: https://polylog.news/crypto/2026-08-03/access-control-and-timing-bugs-drive-a-fresh-round-of-on-cha
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs (Base forwarder)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/f4baf9701b393060378167315c4123fbdde26342), [DeFiHackLabs (Index Coop TOCTOU)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/9d599c284fb444e7b4a1a870073b0a32ab94b580), [Rekt News](https://www.rekt.news/)

While the Coldcard entropy failure dominates this week's losses, the smart-contract layer produced its own steady stream of smaller incidents, each a clear example of a familiar failure mode. The security-research collective DeFiHackLabs pu…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-08-03/access-control-and-timing-bugs-drive-a-fresh-round-of-on-cha (subscription information: https://polylog.news/pricing).