mediumFront-running / MEVEVM-Solidity
Covalent: Frontrunning validator freeze to withdraw tokens
- Payout
- $0
- Protocol
- Covalent
- Disclosed
- Jan 26, 2024
- Source
- sherlock
Covalent's OperationalStaking contract implements a freeze mechanism to disable malicious validators, and a cooldown timelock on withdrawals. Two external functions, transferUnstakedOut() and recoverUnstaking(), omit the `!v.frozen` state check that gates ever …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.