highAccess controlEVM-Solidity
Centrifuge Protocol V3.1: Pool managers can steal all other pools' pending deposits from `globalEscrow` via malicious `requestManager` swapping
- Payout
- $0
- Protocol
- Centrifuge Protocol V3.1
- Disclosed
- Nov 17, 2025
- Source
- sherlock
Centrifuge Protocol's pluggable request-manager design lets pool managers set a spoke request manager for their pool at any time. The flaw is that Spoke.requestCallback() looks up the current requestManager[poolId] when a callback returns from the hub, without …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.