Post Mortem: Hashflow

Hashflow, a multichain decentralized exchange, was exploited on June 14, 2023 resulting in approximately $605k–$640k stolen after an attacker abused an unverified contract's vulnerable 0x1ce5 function (which calls transferFrom) when users had approved transfers; the vulnerable function was not part of the audited code and therefore out of audit scope.