mediumBridge exploitEVM-Solidity
Centrifuge Protocol V3.1: Stranded ETH on batched `crosschainTransferShares` call
- Payout
- $0
- Protocol
- Centrifuge Protocol V3.1
- Disclosed
- Nov 17, 2025
- Source
- sherlock
Centrifuge's VaultRouter exposes a payable crosschainTransferShares function that silently zeroes out msg.value whenever the gateway is in batching mode. In that batched path the gateway is already funded separately, so the router neither forwards nor refunds …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.