highLogic errorEVM-Solidity
Teller Finance: Anyone can steal pool shares from lender group if no-revert-on-failure tokens are used
- Payout
- $0
- Protocol
- Teller Finance
- Disclosed
- Apr 29, 2024
- Source
- sherlock
Teller Finance's LenderCommitmentGroup_Smart.addPrincipalToCommitmentGroup() transfers principal via a raw ERC20 transferFrom() whose boolean return value is ignored. For no-revert-on-failure tokens such as ZRX, a caller can request an amount exceeding their b …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.