highLogic errorEVM-Solidity
Autonomint Colored Dollar V1: `ABONDToken::transferFrom` does not work as intended and allows theft of ETH funds from `Treasury`
- Payout
- $0
- Protocol
- Autonomint Colored Dollar V1
- Disclosed
- Dec 30, 2024
- Source
- sherlock
ABONDToken::transferFrom writes the sender's debited userState to userStates[msg.sender] instead of userStates[from]. Because Approved third-party spenders can invoke transferFrom on another account's tokens, this lets an attacker duplicate a victim's rich yie …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.