[SlowMist: ether.fi attacked, approximately 15.45 ETH lost] BlockBeats news, on September 11, SlowMist tweeted that ether.fi suffered an attack, resulting in a loss of approximately 15.45 ETH. SlowMist stated that they privately contacted the ether.fi team for responsible disclosure before releasing the announcement. According to analysis, the root cause lies in the lack of access control for the `solver` parameter passed by the caller in the `solve()` function of the AtomicQueue contract. There is neither a `solver == msg.sender` check nor signature, registration, or authorization verification. The attacker first used the `updateAtomicRequest()` function to construct a malicious AtomicRequest, then forced the victim's address to act as the solver. AtomicQueue subsequently called `finishSolve` on the victim's address and executed `want.transferFrom(solver, users[i], assetsToUser)`, exploiting the ERC-20 approval previously granted by the victim to steal funds. [Original link]