Ether.fi lost approximately 15.45 ETH after an access-control vulnerability in its AtomicQueue smart contract was exploited. The flaw in the solve() function allowed an attacker to use updateAtomicRequest() to create a malicious request and designate a victim address as the solver. AtomicQueue then called the victim’s finishSolve function and used want.transferFrom to move funds under the victim’s existing ERC-20 allowance. SlowMist privately disclosed the issue to ether.fi before publishing the attacker address and vulnerable contract address. The incident highlights the security risks of smart-contract permissions in decentralized finance, although no specific price movement was reported.