On September 2, 2026, blockchain security firm SlowMist issued a critical alert regarding a smart contract vulnerability in the GebProxyActions contract used by Reflexer Finance’s GEB stablecoin system. The exploit resulted in the theft of approximately 5.9436 ETH in collateral, highlighting persistent security risks in decentralized finance (DeFi).
According to SlowMist, the flaw stemmed from a lack of caller access control in the quitSystem function. The incident occurred when a user directly called the quitSystem function to close a collateral position, also known as a SAFE, instead of routing the transaction through the required DSProxy. This caused the SAFE’s owner to be recorded incorrectly as the GebProxyActions contract rather than the user’s own address.
An attacker recognized the access-control flaw and bypassed the SAFE’s ownership check, withdrawing the collateral to their own address. The victim of the attack included the CollateralJoin1 contract. While the stolen amount was relatively small, the exploit demonstrates that vulnerabilities can arise not only in core smart contract logic but also in the interaction patterns between different protocol components.
Reflexer Finance, known for its RAI stablecoin, had not issued a public statement at the time of reporting, and the community is closely monitoring the situation. The event raises broader questions about current security practices, particularly around user education, interface design, and the assumption that users will always interact through intended intermediaries.
Security experts recommend that DeFi users always interact with platforms through official interfaces and avoid directly calling smart contract functions unless they fully understand the implications. As DeFi evolves, audits should extend beyond simple code review to include comprehensive scenario testing that covers unusual user behaviors.
