highLogic errorEVM-Solidity
Karak: The operator can create a `NativeVault` that can be silently unslashable
- Payout
- $0
- Protocol
- Karak
- Disclosed
- Oct 7, 2024
- Source
- code4rena
In Karak's native restaking module, `Core.deployVaults()` reads the `slashStore` address directly from the operator-supplied `extraData` without any validation. `NativeVault.slashAssets()` hard-reverts with `NotSlashStore` whenever the whitelisted ETH slashing …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-07-karak-findings/issues/55
- https://github.com/code-423n4/2024-07-karak-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.