highReentrancyEVM-Solidity
Oku's New Order Types Contract: attacker can drain StopLimit contract funds through Bracket contract because it gives type(uint256).max allowance to bracket contract for input token in performUpkeep function
- Payout
- $0
- Protocol
- Oku's New Order Types Contract
- Disclosed
- Dec 9, 2024
- Source
- sherlock
Oku's StopLimit contract grants the Bracket contract an unlimited (type(uint256).max) ERC-20 allowance for the input token in its performUpkeep/updateApproval path, needed to fund the internal fillStopLimitOrder call. Because Bracket's own performUpkeep accept …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.