highLogic errorEVM-Solidity
Fluid DEX v2: User can steal funds using `_processNormalSupplyAction` uncapped withdrawal
- Payout
- $0
- Protocol
- Fluid DEX v2
- Disclosed
- Feb 18, 2026
- Source
- sherlock
In the Fluid DEX v2 money-market operate helpers, `_processNormalSupplyAction` caps the raw withdrawal quantity against the user's stored position supply but forwards the user-supplied (uncapped) withdrawal amount unchanged to `LIQUIDITY.operate`. A user can o …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.