CVE-2020-35962

Published: Jan 3, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring (LRC), an Ethereum token, lacks access control for fee swapping and thus allows price manipulation.

Affected (1)

Products: Loopring: Loopring

Loopring

1 product

Loopring

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Loopring Loopring	All versions

References (4)

https://blocksecteam.medium.com/loopring-lrc-protocol-incident-66e9470bd51f

Source: cve@mitre.org

ExploitThird Party Advisory

https://etherscan.io/address/0x4b89f8996892d137c3de1312d1dd4e4f4ffca171

Source: cve@mitre.org

Third Party Advisory

https://blocksecteam.medium.com/loopring-lrc-protocol-incident-66e9470bd51f

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://etherscan.io/address/0x4b89f8996892d137c3de1312d1dd4e4f4ffca171

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.