mediumLogic errorSolana-Rust
Superposition: Tokens are pulled from users without verifying pool status contrary to requirement
- Payout
- $0
- Protocol
- Superposition
- Disclosed
- Jan 7, 2025
- Source
- code4rena
Superposition's Seawater concentrated-liquidity library enforces an enabled-pool precondition inconsistently across the two entry points that pull tokens from users. update_position_internal() asserts pool.enabled is true before taking tokens, but adjust_posit …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-10-superposition-findings/issues/15
- https://github.com/code-423n4/2024-10-superposition-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.