mediumAccess controlEVM-Solidity
The Graph: Governor can rug pull the escrow
- Payout
- $0
- Protocol
- The Graph
- Disclosed
- Aug 7, 2026
- Source
- code4rena
The Graph's BridgeEscrow exposes an approveAll() function that the protocol governor can call to grant any address an unlimited allowance over the escrowed GRT. Because the escrowed tokens are never burned, a compromised or malicious governor could permanently …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2022-10-thegraph-findings/issues/300
- https://github.com/code-423n4/2022-10-thegraph-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.