SlowMist: ether.fi Attacked, Losing Approximately 15.45 ETH

TechFlow reports that on September 11, SlowMist issued a security alert stating that it had first privately contacted the ether.fi team to disclose the related issues. The incident resulted in losses of approximately 15.45 ETH. The root cause lies in the lack of access control in AtomicQueue.solve() over the solver provided by the caller, without verifying solver == msg.sender or performing signature, registration, or consent validation. The attacker crafted a malicious AtomicRequest via updateAtomicRequest(), forcing the victim address to act as the solver, after which the contract called the victim's finishSolve and executed transferFrom, exploiting their existing ERC-20 approvals to transfer funds.