mediumLogic errorEVM-Solidity
Smilee Finance: Transferring ERC20 Vault tokens to another address and then withdrawing from the vault breaks `totalDeposit` accounting which is tied to deposit addresses
- Payout
- $0
- Protocol
- Smilee Finance
- Disclosed
- Mar 6, 2024
- Source
- sherlock
Smilee Finance's Vault is an ERC20 whose per-user deposit accounting (cumulativeAmount and the global totalDeposit) assumes the depositor is the one who later withdraws those shares, but vault shares can be freely transferred between users. By transferring nea …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.