Older ETHMACOAPY Set Protocol Product Loses About 8.11 WETH

An older Set Protocol product on Ethereum lost about 8.11 Wrapped Ether (WETH) in two transactions after a rounding defect let redemptions draw on reserves held for other token holders.

The product, ETHMACOAPY, was affected by the defect in actualizeFee(). The function rounded redemption collateral upward even when no fee was due.

The transactions came from different addresses. In the second transaction, sent two blocks after the first, about 4.062 WETH left the contract, nearly exhausting the reserves recorded for the Set.

The process involved transferring collateral into the contract to trigger a recalculation, then redeeming temporary tokens. The redemption returned more collateral than had been deposited, with the excess taken from reserves held for other token holders.