Slow Mist: EIP-7702 account vulnerability exploited, 1,988.5 QNT stolen

According to market news, attackers exploited a flawed EIP-7702 account to steal 1,988.5 QNT (approximately 54.93 ETH) from the QNT reserve pool. The root cause is that the reserve pool administrator EOA delegated the code to the BatchExecutor contract via EIP-7702, and this contract set the permissionless BatchCall contract as the authorized caller.

Since the BatchCall.batch() function did not have any permission checks set, any external caller could invoke it, ultimately leading to the depletion of the reserve pool assets.