🚨SlowMist TI Alert🚨 💸 MUS Loss: ~$36.9k 🔍 Root Cause: deposit() included the first-deposit bonus in both the immediate ETH refund and the user’s MUS allocation; withdraw() allowed same-transaction redemption without limiting total ETH returned to the amount deposited.
SlowMist reported a loss of approximately $36.9k due to a vulnerability in the deposit and withdraw functions of a protocol. The issue allowed for the first-deposit bonus to be included in both the ETH refund and MUS allocation, and enabled same-transaction redemption exceeding the deposited ETH amount.