highLogic errorEVM-Solidity
Cork Protocol: Incoming Redemption Assets not being tracked when repurchase is called
- Payout
- $0
- Protocol
- Cork Protocol
- Disclosed
- Sep 10, 2024
- Source
- sherlock
Cork Protocol's PsmLib.repurchase() accepts redemption asset (RA) and returns a DepegSwap + pegged asset, but credits the incoming RA through lockUnchecked() instead of recording it in the PsmRedemptionAssetManager.locked counter. Because that internal counter …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.