Security agency: AurelionLabs contract was re-entered initialization attack, resulting in loss of approximately 455,000 USDCs

Blockchain security agency SlowMist tweeted that the Diamond contract related to AurelionLabs was not protected due to the 'initialize(address)' function in SafeOwnableFacet. The attacker re-entered, initialized, tampered with the contract owner and executed 'diamondCut' to inject a malicious Facet containing 'pullERC20', thereby transferring authorized USDC assets. SlowMist said that the affected contracts include addresses such as 0x0adc63e7...(victim contract), 0x2e933518..., 0xa90714a1..., 0xeced2d37... The attacker's address is 0x9f49591a3b... This time, approximately 455,003 USDC were lost.