highLogic errorEVM-Solidity
Peapods: `PodUnwrapLocker` can be drained due to an arbitrary input
- Payout
- $0
- Protocol
- Peapods
- Disclosed
- Feb 17, 2025
- Source
- sherlock
Peapods' PodUnwrapLocker allows users to debond pod tokens without a fee by temporarily locking the underlying assets. The `debondAndLock` entry point never validates that the caller-supplied address is a genuine registered pod, so an attacker can pass a malic …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.