🚨 ALERT — Exploit on Ethereum
@ether_fi Liquid (liquidETH) holders were drained for ~15.45 ETH via the Veda AtomicQueue. A no-capital attacker minted a worthless token, then used the queue to pull real liquidETH out of 11 users who had simply approved it. The whole exploit ran inside a self-destructing contract's constructor.
Root cause:
AtomicQueue.solve(offer, want, users[], runData, solver) settles with want.safeTransferFrom(solver, user, amount) — but solver is an UNAUTHENTICATED caller-supplied address.
Nothing checks it consented (the finishSolve callback is a no-op on a normal EOA).
So anyone who ever approved the AtomicQueue to spend a token can be named as solver and have it pulled.
The attacker made a self-request offering 1 fake token and "wanting" liquidETH at atomicPrice = each victim's approved balance, named the victim as solver, and the queue paid the attacker with the victim's own liquidETH.
price × offerAmount = the amount stolen, sized to drain each approval to the max.
Attack tx:
etherscan.io/tx/0x7cbe0b4349…
Attacker: 0xa5cc6e490bce9185fa47b421f2eac677a83b64ea
Exploit contract: 0x7f5a5f66ebf8afc301ffe37393
Vulnerable AtomicQueue: 0xd45884b592e316eb816199615a95c182f75dea07
✅ If you ever approved this AtomicQueue, REVOKE now.
Subscribe to our TG bot for real-time attack alerts 👉
exvul.com/skyeye-monitor