highLogic errorEVM-Solidity
Arrakis Valantis SOT: ArrakisMetaVault::setModule Malicious executor can drain the vault by calling withdraw after initializePosition
- Payout
- $0
- Protocol
- Arrakis Valantis SOT
- Disclosed
- Jun 4, 2024
- Source
- sherlock
In the Arrakis modular vault built on the Valantis HOT module, the executor who drives ArrakisStandardManager.setModule was trusted only for rebalance actions, but not for module switching. Because setModule lets the caller supply arbitrary payloads that are e …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.