ExVul said the legacy Set Protocol product ETHMACOAPY on Ethereum lost about 8.11 WETH across two transactions sent from different addresses. The issue, according to the monitoring account, came from the way actualizeFee() handled rounding: even when no fee payment was required, the function still rounded up the collateral tied to redemption. ExVul said the attacker first transferred collateral into the contract and triggered a recalculation, then redeemed temporary tokens and withdrew more collateral than had been put in. That process consumed reserves belonging to other holders. In the second transaction, which came two blocks after the first, about 4.062 WETH was transferred out, leaving the reserves recorded for that Set largely depleted.
ExVul said the legacy Set Protocol product ETHMACOAPY on Ethereum lost about 8.11 WETH in two transactions from different addresses.
The flaw was tied to rounding in actualizeFee()
According to ExVul, the root cause was that actualizeFee() rounded up the collateral associated with redemption even when no fee payment was required.
The attacker first sent collateral to the contract and triggered a recalculation, then redeemed temporary tokens and withdrew more collateral than had been deposited. ExVul said that process consumed reserves belonging to other holders.
Second transfer nearly exhausted the recorded reserves
ExVul said the two transactions came from different addresses. In the second transaction, which occurred two blocks later, about 4.062 WETH was transferred out, largely exhausting the reserves recorded for that Set.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
