SlowMist disclosed a missing access-control vulnerability in ether.fi's AtomicQueue that allowed attackers to drain approximately 15.45 ETH by exploiting victim allowances.
Security & Exploits ·
Security researcher SlowMist disclosed a missing access-control vulnerability in ether.fi's AtomicQueue contract that permitted attackers to drain approximately 15.45 ETH by exploiting victim allowances. The vulnerability stemmed from the AtomicQueue.solve() function lacking verification that the caller-supplied solver parameter matched the message sender, and including no signature, registration, or consent checks.
An attacker exploited this gap by crafting a malicious AtomicRequest via the updateAtomicRequest() function, then designating a victim address as the solver. When AtomicQueue called finishSolve on the victim, it executed a transferFrom operation that abused the victim's existing ERC-20 allowance to move funds to the attacker's specified recipients. SlowMist said it reached out to the ether.fi team privately before disclosing the issue publicly.
The attack has been linked to a specific on-chain transaction and attacker address, though it remains unclear whether the vulnerability affected other contracts, whether additional funds were at risk, or what remediation steps ether.fi has taken since receiving notification.