highLogic errorEVM-Solidity
Ammplify: Takers can pay significantly less fees with makers losing these amounts due to `subtreeBorrowedX` and `subtreeBorrowedY` being node's values instead of subtree's
- Payout
- $0
- Protocol
- Ammplify
- Disclosed
- Sep 22, 2025
- Source
- sherlock
Ammplify's liquidity walker stores `subtreeBorrowedX`/`subtreeBorrowedY` as per-node borrowed values rather than the true aggregate of the node plus its children, because unlike `subtreeMLiq`/`subtreeTLiq` these fields are never propagated upward from children …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.