An unverified contract exploit stole about 16.6 WETH, according to SlowMist. SlowMist said the contract lacked access controls and target data validation.