On Ethereum at 2026-05-16 18:15:23 UTC, transaction 0x99a1114c2e8dc1807e00da0e963a6fbd5d91a04d1e1fd0a75b78e9c6b41a7464 was an on-chain plaintext settlement message related to Adshares Wrapper, not the drain transaction itself. The trace shows a single zero-value CALL from 0xb6fe3854a85dc6c2a873f2b6bbd43a36c74cae1f to EOA 0x63e22ce9bde9bb8892a447258abfcaa4142f001b, with ASCII calldata offering whitehat terms and requesting return of 90% of previously drained assets. No contract code executes, no logs are emitted, and funds_flow.json records no token, approval, or ETH transfers, so the financial impact of this transaction itself is 0.

Root Cause

This transaction does not expose a root-cause vulnerability because it never reaches the suspected Adshares Wrapper contract 0xcfcEcFe2bD2FED07A9145222E8a7ad9Cf1Ccd22A. The only trace entry is a top-level message call to an externally owned account, so there is no callable contract function, no state transition inside the wrapper, and no on-chain evidence here for how the earlier drain was performed.

Vulnerable Contract

No vulnerable contract is exercised in this transaction. The incident brief names Adshares Wrapper at 0xcfcEcFe2bD2FED07A9145222E8a7ad9Cf1Ccd22A, but trace_callTracer.json shows that address is never called. The only callee is EOA 0x63e22ce9bde9bb8892a447258abfcaa4142f001b.

Vulnerable Function

Not applicable. The input payload begins with ASCII bytes 0x546f2074 ("To t"), not a Solidity function selector, and decoded_calls.json leaves the call unresolved.

Vulnerable Code

Not applicable for this transaction. No contract bytecode is entered, so there is no vulnerable function body to quote from the verified Adshares Wrapper source.

Why It’s Vulnerable

Expected behavior for an exploit transaction would be a call path that enters the affected protocol contract, executes one or more functions, and produces asset movement or other state changes that can be tied to a concrete code flaw. Actual behavior here is just off-chain-readable text embedded in calldata and delivered to an EOA, with no nested calls and no balance-changing events.

That distinction matters because any attempt to assign an exploit root cause from this transaction alone would be unsupported. This queue item can only support the narrow conclusion that a party controlling 0xb6fe3854... posted settlement terms to 0x63e22c... after an earlier incident.

Attack Execution

High-Level Flow

  1. A sender EOA submits a zero-value Ethereum transaction.
  2. The transaction targets EOA 0x63e22c..., not the Adshares Wrapper contract.
  3. The calldata carries a plaintext message describing whitehat settlement terms.
  4. The EVM records the call successfully and exits without any nested calls.
  5. No tokens, ETH, or protocol state move in this transaction.

Detailed Call Trace

  • Depth 0: 0xb6fe3854a85dc6c2a873f2b6bbd43a36c74cae1f → 0x63e22ce9bde9bb8892a447258abfcaa4142f001b, CALL, value 0
    • input starts with 0x546f2074
    • selectors.json and decoded_calls.json do not resolve this as a Solidity function
    • no child calls

The calldata decodes to plain ASCII text beginning with “To the address that interacted with Adshares Wrapper contract…”. The message offers to treat the prior drain as a whitehat disclosure if 90% of the assets are returned within 72 hours.

Financial Impact

The direct financial impact of transaction 0x99a1114c2e8dc1807e00da0e963a6fbd5d91a04d1e1fd0a75b78e9c6b41a7464 is 0.

funds_flow.json shows:

  • no ERC-20 transfers
  • no approvals
  • no ETH transfers
  • no attacker gains

The only economic effect is gas expenditure by the sender: 53,576 gas at 0x9e74e680 wei, or 0.00013154066571776 ETH. Any actual exploit losses belong to a separate earlier transaction that is not evidenced by this call trace.

Evidence

  • Transaction hash: 0x99a1114c2e8dc1807e00da0e963a6fbd5d91a04d1e1fd0a75b78e9c6b41a7464
  • Chain: Ethereum
  • Block number: 25109461
  • Block timestamp: 2026-05-16 18:15:23 UTC
  • Receipt status: 1
  • Sender: 0xb6fe3854a85dc6c2a873f2b6bbd43a36c74cae1f
  • Recipient: 0x63e22ce9bde9bb8892a447258abfcaa4142f001b
  • Suspected affected contract from the brief: 0xcfcEcFe2bD2FED07A9145222E8a7ad9Cf1Ccd22A
  • Trace shape: one top-level CALL, no nested calls
  • Receipt logs: 0
  • Funds flow summary: No attacker gains detected
  • Unresolved selector bytes: 0x546f2074, which correspond to ASCII text rather than ABI-encoded function dispatch