The ether.fi Exploit: A Case of Missing Access Control
On September 11, blockchain security firm SlowMast disclosed a security incident involving the DeFi protocol ether.fi. The exploit resulted in the loss of approximately 15.45 Ether (ETH). SlowMist noted that they had privately contacted the ether.fi team prior to the public announcement, adhering to responsible disclosure practices.
Root Cause: A Critical Flaw in AtomicQueue
Technical analysis points to a fundamental vulnerability in a core smart contract function. The solve() function within the AtomicQueue contract contained a significant security oversight.
- The Core Issue: The function failed to implement any access control checks on the solver parameter supplied by the caller.
- Missing Safeguards: There was no validation to ensure solver == msg.sender, nor were there any signature checks, registration whitelists, or authorization mechanisms in place.
This basic omission created an opening for malicious manipulation.
Attack Vector: Crafted Requests and Approval Exploitation
The attacker leveraged this flaw through a sequence of actions:
Initially, the attacker crafted a malicious transaction request (AtomicRequest) via the updateAtomicRequest() function. The pivotal step followed—the attacker forcibly designated an unsuspecting user's address to act as the "solver."
When the AtomicQueue contract subsequently called finishSolve on this victim address, it executed the critical line: want.transferFrom(solver, users[i], assetsToUser). While this code was intended to transfer assets *from* the solver to a user, the maliciously assigned solver was the victim. By exploiting the victim's pre-existing, standard ERC-20 token approval granted to the contract for normal operations, the attacker successfully redirected funds from the victim's wallet to an address under their control.
This attack chain underscores how a fundamental lack of permission validation can transform a routine token allowance into a direct conduit for theft.