EtherFiAtomicQueue exploit analysis

Ether.fi's AtomicQueue contract on Ethereum was used to drain 15.45 ETH across 9 distinct users' liquidETH holdings on 2026-09-09 (attack transaction, block 25952624). DeFiHackLabs reconstructs the drain on a mainnet fork against the same real victim allowances, and confirms the impact was against real third-party victims, not a self-contained demo.

AtomicQueue.solve() takes a caller-supplied solver and runs the user's AtomicRequest with that solver as the executor, then settles the resulting token flow through the user's own pre-existing ERC-20 allowance to the queue. The contract gates neither who may call solve() nor which solver may be named, and does not require the user to re-authorize the solver for the request. Each of the 9 victims had previously granted the queue a standing liquidETH allowance from legitimate prior queue use. The attacker replayed each allowance through a worker contract (0x679c53fF03c5c60aAC538a019cA9d69C5DFa663E) that called solve() with an attacker-chosen solver, draining liquidETH at the user's standing allowance. SlowMist noted a private disclosure to ether.fi; whether funds were later returned is out of band for the on-chain trace, which moved real users' funds.

The fix is to gate solve() either to the user themselves or to a solver the user explicitly named in the original AtomicRequest.