highLogic errorEVM-Solidity
Elfi: Anyone can change the balance of an account to drain the entire portfolio vault
- Payout
- $0
- Protocol
- Elfi
- Disclosed
- Jun 20, 2024
- Source
- sherlock
Elfi's AccountFacet exposes `batchUpdateAccountToken`, an unauthenticated state-update function that lets any caller overwrite the recorded balance of an account in the portfolio vault without depositing or transferring underlying tokens. Because the mutation …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.