mediumLogic errorEVM-Solidity
Oku's New Order Types Contract: Malicious User can Poison Bracket.sol with Blacklisted Accounts
- Payout
- $0
- Protocol
- Oku's New Order Types Contract
- Disclosed
- Dec 9, 2024
- Source
- sherlock
Oku's Bracket.sol orderbook lacks validation on the recipient address passed to createOrder, so an attacker can set the recipient to an address blacklisted by the underlying token (e.g. USDC). Because procureTokens pulls from msg.sender rather than the recipie …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.