ether.fi’s AtomicQueue contract lost about 15.45 ETH after attackers exploited an access-control weakness in the contract’s solve() function, according to a disclosure from SlowMist, which said it had notified the ether.fi team and made the attacker and vulnerable contract addresses public.

SlowMist said the issue stemmed from missing access control in the AtomicQueue contract’s solve() function. According to its description, attackers used updateAtomicRequest() to create malicious requests and forced a victim address to be treated as the solver.

SlowMist said that once the request flow was triggered, AtomicQueue called the victim’s finishSolve function and then executed want.transferFrom. In practice, that allowed the attacker to abuse an existing ERC-20 approval and move funds from the victim address.

The disclosed loss was approximately 15.45 ETH. SlowMist said it had shared the vulnerability with the ether.fi team and published the relevant attacker and contract addresses. No further details were provided in the available information on whether the contract was paused, patched, or whether additional losses were identified.

The incident centers on a common DeFi risk area: contract logic that can interact with previously granted token approvals in unintended ways. In this case, the exploit path was tied not to a token flaw itself, but to contract permissions and how a request could be structured and executed against an approved address.

Why It Matters

Even with a relatively limited reported loss, the event is significant because it highlights how access-control mistakes can turn standard ERC-20 approvals into an attack surface. For DeFi protocols, that puts scrutiny on request-routing logic, solver permissions, and the safeguards around contracts that can trigger token transfers.

For users and counterparties, security incidents like this can affect confidence in protocol operations well beyond the immediate amount lost. The broader importance now depends on ether.fi’s response, including whether the issue was isolated, fully contained, and addressed in a way that reduces the risk of similar approval-based exploits.