mediumInteger overflow/underflowEVM-Solidity
Goat Trading: It's possible to create pairs that cannot be taken over
- Payout
- $0
- Protocol
- Goat Trading
- Disclosed
- Mar 31, 2024
- Source
- sherlock
Goat Trading's pair factory (GoatV1Factory) allows createPair() to be called with unvalidated initial bootstrap parameters. An attacker can set virtualEth, bootstrapEth, initialEth, and initialTokenMatch all to type(uint112).max, which causes the internal _tok …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.