mediumAccess controlEVM-Solidity
Arcadia: `LendingPool#flashAction` is broken when trying to refinance position across `LendingPools` due to improper access control
- Payout
- $0
- Protocol
- Arcadia
- Disclosed
- Feb 16, 2024
- Source
- sherlock
Arcadia's lending architecture lets a user refinance a position by moving it between LendingPools through LendingPool#flashAction, which hands temporary control to a new (pending) creditor. That flow first calls AccountV1.updateActionTimestampByCreditor(), but …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.