ether.fi Liquid AtomicQueue Missing Access Control — $38.1K, Fully Reimbursed

On September 11, 2026, an attacker exploited a missing access control check in the solve() function of a legacy AtomicQueue contract used by ether.fi's Liquid product (built on the Veda framework). The function failed to verify that the caller (solver) matched the expected msg.sender, allowing the attacker to force already-approved addresses to act as solvers and drain funds via transferFrom. Approximately 15.45 ETH (~$38,130 on mainnet, with a wider ~$43,260 figure including copycat attempts on Arbitrum) was extracted, affecting 11 users, several using EIP-7702 smart wallets. SlowMist conducted responsible disclosure prior to public reporting. All affected users were fully reimbursed by the protocol.