Blockchain security firm SlowMist said on X that ether.fi was hit by an attack that resulted in a loss of about 15.45 ETH. The firm added that it had contacted the ether.fi team privately for responsible disclosure before making the incident public.
According to SlowMist’s analysis, the root cause was an access-control issue in the AtomicQueue contract’s solve() function. The function did not verify whether the supplied solver parameter matched msg.sender, and it also lacked signature, registration, or authorization checks.
SlowMist said the attacker first crafted a malicious AtomicRequest through updateAtomicRequest(), then forced a victim address to act as the solver. AtomicQueue then called finishSolve on the victim address and executed want.transferFrom(solver, users[i], assetsToUser), allowing the attacker to drain funds by using ERC-20 token allowances that the victim had previously granted.
SlowMist said on X that ether.fi suffered an attack, with losses of about 15.45 ETH.
The security firm said it had privately contacted the ether.fi team for responsible disclosure before publishing its notice.
Issue traced to the AtomicQueue contract
According to SlowMist, the root cause was that the AtomicQueue contract’s solve() function lacked access control over the caller-supplied solver parameter. It did not check whether solver == msg.sender, and it also had no signature, registration, or authorization verification.
How the attack worked
SlowMist said the attacker first used updateAtomicRequest() to craft a malicious AtomicRequest, then forced a victim address to act as the solver. AtomicQueue then called finishSolve on the victim address and executed want.transferFrom(solver, users[i], assetsToUser), stealing funds through ERC-20 allowances that the victim had previously granted.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
