Atomic Green on Arbitrum hit by signature replay exploit, roughly $30,000 in USDC lost
Atomic Green, a project on Arbitrum, was hit by a signature replay exploit that appears to have drained about 29,984.27 USDC, according to a security alert from SlowMist shared on X.
Atomic Green (Arbitrum) reported an exploit causing ~29,984.27 USDC loss.
SlowMist says a signature replay flaw let one manager signature be reused across 21 Uniswap V3 LP position IDs, enabling unauthorized full LP burns under flashloan-manipulated pricing.#DeFi #Security
— SolidityScan (@SolidityScan) August 10, 2026
The firm said the attack stemmed from a reused manager signature that could be applied across multiple Uniswap V3 LP position IDs, allowing unauthorized burns of liquidity positions under manipulated pricing conditions.
SlowMist said the issue affected contract 0xa806010f and pointed to missing bindings in the signature design, including position ID, manager, caller, nonce, deadline and chain ID. In its account of the incident, the same signature was reportedly reused across 21 position IDs, while a flashloan was used to influence pricing during the unauthorized partial burn process.
How the exploit worked
According to SlowMist, the attacker address was 0xf8803dae13a6757e53711214769b5fb52ec26c7e. The firm also said the contract did not include TWAP or slippage checks, which left the position-burn flow exposed when pricing was manipulated. That combination, it said, allowed the attacker to carry out the unauthorized burns and extract USDC from the affected setup.
The security firm did not frame the incident as a broader Arbitrum issue, but as a contract-level failure tied to Atomic Green’s signature handling. The details it published suggest the loss was limited to the project’s affected position contracts rather than a chain-wide problem.
The report adds to the growing list of DeFi incidents where signature design, permission scope and pricing protections determine whether an attacker can reuse a valid authorization in an unintended context. In this case, the weakness described by SlowMist centered on replayable signatures and the absence of safeguards around execution conditions.
