highLogic errorEVM-Solidity
Notional Exponent: Hardcoded `useEth = true` in `remove_liquidity_one_coin` or `remove_liquidity` lead to stuck fund
- Payout
- $0
- Protocol
- Notional Exponent
- Disclosed
- Jul 18, 2025
- Source
- sherlock
Notional Exponent's single-sided LP Yield Strategy vault enters Curve V2 two-token pools with use_eth derived from msg.value (false when the underlying is WETH), but hardcodes useEth=true on every exit. For pools whose Coin 0 (ETH_INDEX) is WETH — e.g. the t/E …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.