Security firm: Aurellion Labs contract suffered a reentrancy initialization attack, resulting in the loss of approximately 455,000 USDC.

ChainCatcher news, blockchain security firm SlowMist tweeted that the Diamond contract related to Aurellion Labs was exploited because the `initialize(address)` function in the SafeOwnable Facet was unprotected. The attacker reentered to initialize and tampered with the contract owner, then executed `diamondCut` to inject a malicious Facet containing `pullERC20`, thereby transferring authorized USDC assets. SlowMist stated that the affected contracts include 0x0adc63e7... (victim contract), 0x2e933518..., 0xa90714a1..., 0xeced2d37..., and so on. The attacker’s address is 0x9f49591a3b..., and the total loss is approximately 455,003 USDC.