highAccess controlEVM-Solidity
stNXM by EaseDeFi: The vault can be drained
- Payout
- $0
- Protocol
- stNXM by EaseDeFi
- Disclosed
- Nov 21, 2025
- Source
- sherlock
stNXM by EaseDeFi is a staking vault whose owner-only stakeNxm() function lacks validation of the requested staking NFT tokenId. Because stakeNxm() executes from the vault contract, the underlying depositTo() call passes address(this) as msg.sender, so a malic …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.