mediumLogic errorEVM-Solidity
Mellow Modular LRTs: User may not receive profit from withdrawal fee as expected and attacker can steal value from pool
- Payout
- $0
- Protocol
- Mellow Modular LRTs
- Disclosed
- Jun 27, 2024
- Source
- sherlock
Mellow's Modular LRT vault processes batched withdrawal requests against a frozen state stack in which totalSupply and totalValue are captured once at the start of the batch. Because the withdrawal fee levied on each request is never reflected in the LP-share …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.