mediumOracle manipulationEVM-Solidity
Zivoe: OCL_ZVE.sol::forwardYield relies on manipulable Uniswap V2 pool reserves leading to theft of funds
- Payout
- $0
- Protocol
- Zivoe
- Disclosed
- Apr 25, 2024
- Source
- sherlock
Zivoe's OCL_ZVE locker distributes yield earned on its Uniswap V2 ZVE/pairAsset LP position by calling fetchBasis, which converts the LP token balance into a claimable USDC amount derived from current pool reserves. Because forwardYield unconditionally overwri …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.