mediumLogic errorEVM-Solidity
Mellow Modular LRTs: Corrupted oracle system if more than 2 underlying tokens are used and one of them is WSTETH
- Payout
- $0
- Protocol
- Mellow Modular LRTs
- Disclosed
- Jun 27, 2024
- Source
- sherlock
Mellow's ChainlinkOracle.priceX96() unconditionally enforces a cross-oracle price check that forces every underlying token to be denominated through a single base token and an intermediate feed. Because wstETH must be priced via WStethRatiosAggregatorV3 (which …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.