D.O.S due to wrong scaling factor

Lines of code Vulnerability details Impact The cNote token which is a fork of the CToken contract has a scaling method used to handle the exchange rate between CToken and the underlying token. This method helps scale the exchange rate because solidity doesn't handle fixed-point decimals. The...

Possible sandwhich attack whenever a user with a surplus of allowance calls market.buy().

Lines of code Vulnerability details Impact Because the exact amount of allowance a user needs to mint his desired amount of shares isnt always a round number as shown via the market.getBuyPriceid, amount;. There could be users who might trust the contract blind & approve their entire balance in...

Price can be easily inflated/deflated by large depositors in the Market contract

Lines of code Vulnerability details Impact An attacker can manipulate/inflate market prices by donating/buying large amounts of tokens which can negatively impact subsequent transactions. For example, an attacker who executes a large buy order can significantly increase the price of shares, causi...

asD TOKEN CREATOR CAN PROFIT UNFAIRLY FROM THE cNote TOKENS DIRECLTY TRANSFERRED TO THE asD.sol CONTRACT

Lines of code Vulnerability details Impact The asD.withdrawCarry function is used to withdraw the interest that accrued in the asD contract in the form of NOTE tokens. Only the owner of the asD token is able to withdraw the interest accrued since the withdrawCarry is controlled by the onlyOwner...

Lost fees

Lines of code Vulnerability details Impact Buyers do not get any split of the fees. It is instead to be distributed to holders. But holder splits on successive buys are partially lost to the contract and cannot be recovered. Proof of concept The buyer's rewardsLastClaimedValueidmsg.sender is...

Use contracts-upgradeable instead of contract variants of OpenZeppelin

Lines of code Vulnerability details Impact OpenZeppelin’s contracts variants when used with upgradeability will result in negative impact on the overall contract functionality. Check this OpenZeppelin warning about mixing contract variants with upgradeable-contract. Proof of Concept Upgradeable...

Mint amount calculation in deposit is incorrect

Lines of code Vulnerability details Summary The calculation in the deposit function of the DepositPool contract is flawed as it factors the deposited amount into the RSETH price to calculate the amount to mint. Impact When a user deposits in the DepositPool contract, the amount of RSETH to mint i...

User can not receive own assets back

Lines of code Vulnerability details Impact The user has the opportunity to deposit tokens, but does not have the opportunity to withdraw them back. Consequently, his tokens will be locked in the contract and he will not be able to take them back. Yes, the contract is upgradable - but this does no...

The rsETH price can be manipulated easily when the deposit is low

Lines of code Vulnerability details Impact The rsETH price can be manipulated easily when the deposit is low, since the price is relies on the contracts' balance. Proof of Concept The rsETH's price is calculated by $\fractotalassetvaluetotalsupply$, and when supply is zero, the price will be 1...

Missing pause checks in LRTOracle

Lines of code Vulnerability details Summary The LRTOracle oracle provides functionality to pause the contract but no restrictions are applied when the contract is in a paused state. Impact Similar to the other contracts in the protocol, the LRTOracle contract offers pausing functionality: 101: //...

Malicious first depositor can steal all funds from all future depositors

Lines of code Vulnerability details Impact Due to a miscalculation in LRTOraclegetRSETHPrice, users who call LRTDepositPooldepositAsset when rsETH.totalSupply is non-zero will receive fewer rsETH tokens than they should due to a rounding error. This can be exploited by a malicious first depositor...

Changing rsETH address breaks contract

Lines of code Vulnerability details Impact manipulating rsETH price Proof of Concept admin can change rsETH token address, while total supply of rsETH is used to calculate its price changing rsETH address changes its price. Tools Used Manual Review Recommended Mitigation Steps prevent changing...

Users get pay for multiple NFTs and only get 1 minted

Lines of code Vulnerability details Impact Users get only 1 NFT after paying for multiple or more than one Proof of Concept In MinterContract.mint users can mint more than one token and are allowed to pay for the number of tokens minted. function mint uint256 collectionID, uint256 numberOfTokens,...

Royalty Payment Invariant Violation

Lines of code Vulnerability details Impact The vulnerability in the payment mechanism of the smart contract significantly impacts the protocol's functionality. The root cause of the vulnerability is that, despite the README stating an invariant that "Payments can only be made when royalties are...

No function to distribute secondary sales royalties split.

Lines of code Vulnerability details Impact The minter contract currently does not have a way to reliably share the secondary sales revenue for the proposed addresses and splits. Proof of Concept Contract : NextGenMinterContract The minter contract uses collectionArtistSecondaryAddresses and...

Missing Reentry Protection in 'emergencyWithdraw' function

Lines of code Vulnerability details Ensure that all state changes in emergencyWithdraw are done before the external call to prevent reentrancy attacks. The function is vulnerable to reentrancy attacks due to the use of .callvalue: balance"". This can be mitigated by adding a reentrancy guard.- Po...

mint with sales option 3 doesn't work as expected

Lines of code Vulnerability details Summary lastMintDatecol is set to be higher than expected, which can lead to the minting process being blocked for some time. Vulnerability Details In the mint function in the MintContract if the salesOption of the collection is set to 3 then we can only mint 1...

Missing deadline checks

Lines of code Vulnerability details Consider addings implementation to handle the expiration of the transaction for additional security. To implement a transaction expiration mechanism in the emergencyWithdraw add a timestamp check to ensure that the transaction is executed only within a certain...

Adding a randomizer to a collection should be mandatory

Lines of code Vulnerability details Impact The minting process will be broken. Proof of Concept In the current setup, a randomizer contract can be associated with each collection, and it plays a crucial role in generating a random value for token uniqueness during the minting process. Here's a...

When the burnToMint function is enabled, any bad actor can transfer the nft-to-burn when it receives the newly minted nft, getting burned after he no longer is the owner.

Lines of code Vulnerability details Impact Medium impact, it affects the functionallity of the nfts with other contracts, as they wouldn't want to interact with tokens that could get burned. Explanation in the NextGenCore contract, the burnToMint function has the minting of the new nft, which mak...