highLogic errorEVM-Solidity
Exactly Protocol: Unassigned pool earnings can be stolen when a maturity borrow is liquidated by depositing at maturity with 1 principal
- Payout
- $0
- Protocol
- Exactly Protocol
- Disclosed
- May 4, 2024
- Source
- sherlock
In Exactly Protocol's fixed-rate market, liquidating a borrower's maturity loan calls noTransferRepayAtMaturity() with canDiscount=false, so unassigned pool earnings are not folded into the earningsAccumulator and subtracted from the repay. Those earnings late …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.