Nexera DeFi Protocol Hacked: $1.8M Stolen in Major Smart Contract Exploit

Learn how a smart contract vulnerability led to the theft of $1.8 million from Nexera, a DeFi protocol.…...

Malicious seller can finalize his/her auction without changing data.lowestQuote , then auction's state will not be updated to States.finalized and this seller can repeat finalize or cancel auction to steal tokens from contract

Lines of code Vulnerability details Vulnerable details In contract, an auction's state will beStates.Finalized if data.lowestQuote of this auction is different from typeuint128.max. L33-34 data.lowestQuote is assigned to equal clearingQuote when seller finalize auction. L238 This value will be...