highAccess controlEVM-Solidity
Crestal Network: Anyone who is approving `BlueprintV5` contract to spend ERC20 can get drained because `Payment::payWithERC20`
- Payout
- $0
- Protocol
- Crestal Network
- Disclosed
- Mar 14, 2025
- Source
- sherlock
Crestal's BlueprintV5 agent-creation flow relies on an internal `Payment::payWithERC20` helper to move the payment token from a user to the protocol. The function is declared `public` and accepts arbitrary `fromAddress`, `toAddress` and `amount`, with only tri …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.