Veda’s AtomicQueue allowed the caller of solve() to supply an arbitrary solver address without authenticating that the address had consented to participate as the solver. The settlement logic then executed want.safeTransferFrom(solver, user, amount). The attacker created a worthless token, submitted a self-request offering that token in exchange for liquidETH, and supplied existing liquidETH holders as the solver. Because those holders had previously approved AtomicQueue, the contract used their allowances to pull liquidETH directly from their wallets and transfer it to the attacker’s request. Eleven users were drained in a single transaction

Users of ether.fi Liquid (liquidETH) lost ~15.45 ETH after an attacker exploited missing access control in AtomicQueue.solve() on the caller-supplied solver parameter. The attacker crafted a malicious AtomicRequest, forced already-approved victim addresses to act as solver, and drained funds via existing ERC-20 allowances with transferFrom. About 11 users were affected.