A NEAR-based smart contract lost about 24.7 ETH after an access control flaw let unauthorized users trigger functions they should not have been able to call. The issue was first flagged by @SlowMist_Team and later confirmed through on-chain activity. It was not a stolen private key. It was not a compromised wallet. The failure sat inside the contract logic itself, where a missing check left the door open.
What Went Wrong
The report points to two affected parts: an order factory and a victim account system. Those components manage order creation and account-level data. When access controls fail there, the damage can spread beyond one balance. Other contracts built on the same patterns may face similar questions. That is the part developers will watch closely.
The exploit class is not new. Missing access control is one of the most common smart contract bugs. Auditors are trained to find it. So its appearance here raises a harder question: why did it reach a live contract that held funds? The answer may involve the review process, the deployment pipeline, or both. Without a full technical postmortem, it is hard to say which failed.
For now, the exact path of the exploit remains partly unclear. The report does not detail every transaction or every function involved. That leaves room for speculation, which is rarely helpful. What is clear is that the contract allowed an action it should have blocked. Once that happens, funds can move fast, and recovery is difficult. NEAR has built much of its appeal around developer-friendly tools and low fees. Security lapses cut against that pitch. A single breach of 24.7 ETH may not break the network. It does add pressure on teams to prove their contracts are safe.
Market Reaction Stays Quiet
The market response has been muted. Traders did not rush for the exits, at least not visibly. But quiet does not always mean calm. It can mean people are waiting. For NEAR, the bigger risk may be slower participation, not an immediate price shock. A small loss can still shake confidence if users start asking whether other contracts share the same weakness.
Pressure for Better Audits
Expect calls for tighter access controls before deployment, not after. Independent reviews, more testing of permissions, and clearer ownership checks are likely to come up. Regulators may also take note, though no formal action has followed. The case reinforces a familiar pattern: code-level security failures can reach market confidence and policy talks. The fix may be technical, but the trust problem is not.
