Nice analysis. However I'd like to add that the callback function is not actually "any caller call-able". Otherwise the attacker can just call the swap callback function to profit. And only native gas token held by the contract is vulnerable. The root cause appears to be the

*checks saffron*

If you're an LP dm me 𐁉

How to grow your yield using Saffron vaults: a case study in multiplying Uniswap Labs 🦄 fees. This Saffron vault has been live on Uniswap for 1 week. First, an AAVE/ETH LP deposited into Saffron to earn fixed yield. Next, they were paid 8.79% upfront by a yield speculator who

At DevConnect Buenos Aires, the details of EIL EIL - Ethereum Interoperability Layer were unveiled. We’ve been deep-diving interop protocols for months and our initial assessment of EIL contracts (deployed on testnets already) is following 🧵👇

Me when I look at variable rates onchain

1/3🧵 We've recently completed an audit of Saffron new Uniswap Labs 🦄 V3 yield derivative codebase that enables a special marketplace: LPs receive upfront payments for locking positions, while users trade the resulting yield.

There was a website from 15 years ago hasthesystemcollapsedyet.com that predicted that this exact turn of events would happen