mediumBridge exploitEVM-Solidity
Tapioca: USDO’s MSG_TAP_EXERCISE compose messages where exercised options must be withdrawn to another chain will always fail due to wrongly requiring sendParam's to address to be whitelisted in the Cluster
- Payout
- $0
- Protocol
- Tapioca
- Disclosed
- Mar 15, 2024
- Source
- sherlock
Tapioca's USDO compose-message system lets users exercise tap options and either receive the resulting tapOFTs locally or bridge them to a destination chain. In the bridging path, UsdoOptionReceiverModule.exerciseOptionsReceiver() applies an extra Cluster whit …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.