mediumLogic errorEVM-Solidity
Arcadia: `CREATE2` address collision against an Account will allow complete draining of lending pools
- Payout
- $0
- Protocol
- Arcadia
- Disclosed
- Feb 16, 2024
- Source
- sherlock
Arcadia's account Factory deploys user accounts via CREATE2 where the salt is derived from attacker-influenced inputs (a user-supplied salt combined with tx.origin), effectively putting the deployed account's address under the user's control. An attacker can r …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.