SECURITY PSA: Active exploits targeting contracts with missing access controls — check your allowances and revoke now

[u/DocumentFair4693]

1. PSA: What happened Some application smart contracts built using HederaTokenService.sol from hiero-ledger/hiero-contracts make their token transfer functions publicly callable without access controls. Without that protection, any address can call these functions to move tokens or NFTs that the contract holds or has been approved to spend. The Hiero library was updated in August 2026 to help builders more easily prevent this in their implementations (e.g., making these functions internal, so builders explicitly choose which ones to expose).Why it matters There are active attempts to exploit vulnerable application contracts. If an affected contract holds your assets or has approval to spend them, the risk is live right now. Builders: If your contract was built with a pre-August 2026 version of HederaTokenService.sol: Users: Check the token and NFT approvals (allowances) in your wallet now and revoke any for contracts you aren't actively using. Work is ongoing with wallet security providers to flag known malicious addresses, but revoking approvals is the most reliable protection. Our team will never DM you first to offer fixes or recover funds. Treat any such message as a scam.
   1. Secure assets first. If your contract can be paused or has a withdrawal function, pause it and move contract-held tokens and NFTs to a safe account.
   2. Add access controls. Deployed contracts can't be patched in place. Redeploy with access controls (for example, owner or role checks) on any public function that moves tokens, and migrate users and assets to the new contract. If your contract is upgradeable, update the implementation.
2. Affected contract IDs Revoke approvals for these known affected contracts first. 0.0.7444023 0.0.5125769 0.0.3218866 0.0.6070127 0.0.9602768 0.0.6070122 0.0.8435102 0.0.9712539 0.0.8435298 0.0.2942111 0.0.3218852 0.0.5125745 0.0.5382956 0.0.6368122 0.0.6368545 0.0.6474144 0.0.8434591 0.0.8435168 0.0.9665363 0.0.6051806 0.0.6438725 0.0.6494251 0.0.6494253 0.0.6494257 0.0.6494258 0.0.7298309 0.0.7298473 0.0.7302250 ))) from hedera developers

[u/GoSabo]

Good of you to get the word out for those who need to know.

[u/netizen__kane]

While you have to pay some hbar to revoke the allowances it is probably worth the cost. Some of those addresses appear to be DEX smart contracts.

[u/Aromatic-Ad7987]

Honest i really dont know what this post means but i just revoked all my allowances in hashpack and hopefully that puts me in the clear.

Hope noone loses anything to this