Arbitrary from in transferFrom

Lines of code Vulnerability details Impact function aaddress from, address to, uint256 amount public erc20.transferFromfrom, to, am; Alice approves this contract to spend her ERC20 tokens. Bob can call a and specify Alice's address as the from parameter in transferFrom, allowing him to transfer...

[MEDIUM] NFTBoostVault#addNftAndDelegate - Not setting a delegatee in the addNftAndDelegate will cause the addTokens function and updateNft to revert

Lines of code Vulnerability details Impact The absence of a delegatee in the addNftAndDelegate function in the NFTBoostVault contract will cause the addTokens and updateNft functions to revert. This is due to the assumption that a delegatee has been set, which is not always true. This issue may...

Loss of previous spending power for same spender address in Treasury Contract

Lines of code Vulnerability details Line of code: Impact Lose of previous spending power for same address in TreasuryContract Proof of Concept the AracheTreasury, there are three spending relate function: approveSmallSpend, approveMediumSpend, approveLargeSpend both of these function call...

ecrecover can return undefined data if signature does not verify

Impact the ecrecover precompile does not fill the output buffer if the signature does not verify, see https://github.com/ethereum/go-ethereum/blob/b058cf454b3bdc7e770e2b3cec83a0bcb48f55ee/core/vm/contracts.goL188. however, the ecrecover builtin will still return whatever is at memory location 0...

The is no way for native tokens to get sent to InterchainProposalExecutor

Lines of code Vulnerability details Impact Proposals that require value cannot be executed as native tokens on the other side of the bridge cannot be provided. Proof of Concept Proposals have a value parameter, which allows users to specify what amount of native tokens should be passed when calli...

onlyProxy MODIFIER CAN BE BYPASSED BY A MALICIOUS PROXY CONTRACT AND CAN PUSH THE IMPLEMENTATION CONTRACT INTO AN UNDESIRABLE STATE

Lines of code Vulnerability details Impact The Upgradeable.onlyProxy modifier is used to ensure that a function can only be called by the proxy and can not be directly called in the Upgradeable.sol contract. The onlyProxy modifier implementation is as follows: modifier onlyProxy // Prevent setup...

InterchainTokenService.expressReceiveTokenWithData does not apply Check-Effect-Interaction mode

Lines of code Vulnerability details Impact InterchainTokenService.expressReceiveTokenWithData does not apply the Check-Effect-Interaction pattern. In some edge cases, the caller can lose funds. Proof of Concept The life cycle of sending token across chains contains 3 phases: //P1: launch on sourc...

Gas refunds are returned to the wrong address, leading to loss of funds for the payer

Lines of code Vulnerability details Impact To pay for cross-chain messages/calls, a user/third-party service must pay a reasonable fee in this case using the native token. However, often times a user will overpay to ensure that there is an adequate buffer for their tx to successfully succeed in...

Unauthorized Contract Upgrade Vulnerability in Upgradable Contract

Lines of code Vulnerability details In the "upgrade" function, the contract allows the owner to upgrade the contract to a new implementation using the provided address and code hash. However, there is a flaw in the implementation that can allow an attacker to bypass the contract upgrade checks an...

Risk of Rogue Signer Control: Potential for Malicious Signer to Modify Threshold and Gain Unauthorized Control of Multisig Contract

Lines of code Vulnerability details Impact The "Rotation of Signers" mechanism in the Multisig contract poses a risk of a single rogue or compromised signer gaining unauthorized control of the contract. If a signer with malicious intent or compromised credentials utilizes the rotateSigners...

Collateralization ratio manipulation can cause a denial of service

Lines of code Vulnerability details Impact Stablecoin redeeming and profit accruing in the SavingsVest contract can be blocked when the collateralization ratio has overflown. Proof of Concept The mitigation recommended in 31 and implemented by the sponsor in this commit doesn't resolve the root...

Using controlled delegatecall could in calling _deployTokenManager.tokenManagerDeploy()

Lines of code Vulnerability details Impact The use of delegatecall in this context poses a security risk. When using delegatecall, the called contract's code is executed within the context of the calling contract. This means that the deployTokenManager function is executed as if it is part of the...

[H] Address collisions due to lack of check on the salt parameter

Lines of code Vulnerability details Impact In ConstAddressDeployer, functions deploy and deployAndInit do not check for the same salt value being passed in by different users. This can lead to address collisions. If someone passes the same salt value as someone else, even with different bytecode...

Voter/caller's eth will be stuck in contracts if the proposal fails to pass

Lines of code Vulnerability details Impact Voters of AxelarServiceGovernance.sol:executeMultisigProposal or callers of Multisig.sol:execute will have their eth stuck in the contract if they can't make the proposal/call pass the vote count checks in onlySigners. Proof of Concept...

Reentrant Call Vulnerability in ExpressCallHandler Contract

Lines of code Vulnerability details DISCRIPTION The ExpressCallHandler contract contains a potential bug related to handling the express calls. The issue lies in the setExpressReceiveToken and setExpressReceiveTokenWithData functions. Specifically, these functions don't properly handle reentrant...

InitProxy and Proxy may revert preventing successful init

Lines of code Vulnerability details Impact When InitProxy is constructed the owner is set to be the sender address so that the init function can only be called by the same sender address. If the init function is receiving a new owner, the implementation may revert during setup preventing proxy...

Users do not get charged for the value their proposal will need

Lines of code Vulnerability details Impact Depending on whether the destination chain InterchainProposalExecutor's native token balance the transaction will either steal funds or will fail. Proof of Concept Users can provide an amount of native tokens they want to send to the call they will make ...

Incorrect amount of tokens is transferred before updating the accumulator and emitting the ContributePrizeTokens event

Lines of code Vulnerability details Impact An attacker can call the contributePrizeTokens function with a lower amount of tokens than claimed, misleading the contract to update the accumulator and emit the event based on the incorrect amount. As a result, the prize pool's internal state will be...

IF THE UNDERLYING ASSET IS A FEE ON TRANSFER TOKEN IT COULD BREAK THE INTERNAL ACCOUNTING OF THE VAULT

Lines of code Vulnerability details Impact The Vault.deposit function is used by the users to deposit assets to the vault and mint vault shares to the recipient address. The amount of assets are transferred to the Vault as follows: SafeERC20.safeTransferFrom asset, caller, addressthis,...

Pending owner can be the wrong recipient of ownership

Lines of code Vulnerability details Impact An attacker can call the acceptOwnership function with their address as the pending owner before the legitimate pending owner has a chance to call the function Proof of Concept The transferOwnership function allows the current owner to set a pending owne...