ether.fi Liquid

Veda’s AtomicQueue allowed the caller of solve() to supply an arbitrary solver address without authenticating that the address had consented to participate as the solver. safeTransferFrom(solver, user, amount).

The attacker created a worthless token, submitted a self-request offering that token in exchange for liquidETH, and supplied existing liquidETH holders as the solver. Because those holders had previously approved AtomicQueue, the contract used their allowances to pull liquidETH directly from their wallets and transfer it to the attacker’s request.

Eleven users were drained in a single transaction.