highLogic errorEVM-Solidity
Cork Protocol: Users redeeming early will withdraw `Ra` without decreasing the amount locked, which will lead to stolen funds when withdrawing after expiry
- Payout
- $0
- Protocol
- Cork Protocol
- Disclosed
- Sep 10, 2024
- Source
- sherlock
Cork Protocol's early redemption path in VaultLib::redeemEarly() carries an accounting bug in the locked-Ra ledger. When a user burns Lv early, the vault swaps the paired Ct/Ds for Ra via PsmLib::lvRedeemRaWithCtDs() and pays the Ra out, but never calls decLoc …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.