Risk of flashloan attacks in the Staking contract

Lines of code Vulnerability details Impact An attacker can steal a large amount of rewardsToken from the Staking contract by using flashloans, thus all the users will receive less rewards for their staked amounts. Proof of Concept In the Staking contract any user can stake a given amount of...

Rewards for the Staking.sol contract may be stolen via the first staker

Lines of code Vulnerability details Impact The return amount of the function rewardPerToken may be inflated for the first in the Staking.sol contract. Proof of Concept The Staking.sol contract is designed for the LOT token holders to be able to stake their native tokens. Thus, the token holders...

Division before multiplication lead to truncation

Lines of code Vulnerability details Impact Calculation could result in truncation. Proof of Concept Staking.solL60-L64 : function earnedaddress account public view override returns uint256 earned return balanceOfaccount rewardPerToken - userRewardPerTokenPaidaccount / 1e18 + rewardsaccount; above...

Winnings might be unable to catch up with prize pot

Lines of code Vulnerability details Impact Profit may become ineffective, meaning that funds are effectively stuck in the contract. Proof of Concept Funds are owned by the Lottery and the only way out is through payouts. However, since the jackpot is bound by jackpotBound the expected payout taki...

Funds can be stuck in DAO contract

Lines of code Vulnerability details Impact The DAO contract allows for depositing tokens and native coins, but it does not properly account received funds neither allows it to withdraw them afterwards. Due to that, anyone depositing into DAO contract won't be able to withdraw their funds. Proof o...

LUSDT non-compliance with the EIP-2612 standard

Lines of code Vulnerability details Impact Inability to integrate LUSDT into contracts of other services where the DOMAINSEPARATOR is used or strict adherence to the EIP2612 standard is required. Various network analyzers that automatically determine the type of contracts will not be able to...

LQTYStaking.sol – Reentrancy risk in stake() unstake() functions

Lines of code Vulnerability details In the LQTY smart contract, the stake and unstake functions are used to add or remove a certain amount of LQTY tokens from a user's stake, respectively. Both functions are designed to update the user's stake and the total amount of LQTY staked while allowing...

Max approve will not work for tokens that do not support it

Lines of code Vulnerability details Impact Max approve does not work for all tokens types Proof of Concept Inside the ReaperBaseStrategyv4 contract initializers, the contract is doing a max approve for the vault over the underlying asset, however this will not work for all tokens types Tools Used...

Index of removed Trove is not updated

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. In the function removeTroveOwner in the TroveManager contract the Trovesborrowercollateral.arrayIndex is still equal to its previous index even though it has been removed from TroveOwners and therefore...

Attacker contract can avoid being blocked

Lines of code Vulnerability details Impact A Malicious attacker can interact with the system and selfdestruct his own contract then use CREATE2 to recreate it at same address when he needs to interact with the system again. Proof of Concept Tools Used Manual Review Recommended Mitigation Steps...

Depositors might not be able to withdraw from StabilityPool if any collateral's price drops significantly

Lines of code Vulnerability details In the TroveManager contract, the closeTrove function contains a check to ensure there is more than one trove, as shown below. TroveManager.solL1278-L1282: function closeTroveaddress borrower, address collateral, Status closedStatus internal assertclosedStatus ...

Centralization Risk for trusted owners

Lines of code https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos...

Ethos stil using LUSD (not ERN) will lead to confusion and ambiguity of the protocol resulting uncountable risk for the project

Lines of code Vulnerability details Impact Ethos stil using LUSD not ERN will lead to confusion and ambiguity of the protocol resulting uncountable risk for the project Proof of Concept Ethos is a fork project of Liquity with additional changes, supporting multi collateral tokens. There are some...

No Contract Compiled Yet, missing "contract RegistryUtils{...}" in in file packages/contracts/src/framework/utils/RegistryUtils.sol

Lines of code Vulnerability details Impact packages/contracts/src/framework/utils/RegistryUtils.sol file is missing "contract", here there is one function function isSubdomainValid and it will not compile. isSubdomainValid is called in several places,...

Upgraded Q -> 2 from #3 [1678055596601]

Judge has assessed an item in Issue 3 as 2 risk. The relevant finding follows: L-01 The removeContract function is not properly implemented Impact The contracts array of MaltRepository contract would be messed up, devs and users would not be able to obtain correct contract string names by the...

CVE-2023-26488 OpenZeppelin Contracts contains Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

@1inch/delegating (>=0.0.8, <=0.0.21), @1inch/erc20-pods (>=0.0.8, <=0.0.17) +67 more potentially affected by CVE-2023-26488 via @openzeppelin/contracts (>=4.8.0, <=4.8.1)

@openzeppelin/contracts NPM version =4.8.0, =0.0.8, =0.0.8, =1.1.2, =0.0.1, =2.0.0, =0.7.0-alpha, =1.2.0, =0.0.1, =1.0.4, =1.0.1, =1.0.15, =2.0.2 and more Source cves: CVE-2023-26488 Source advisory: OSV:GHSA-878M-3G6Q-594Q...

Upgraded Q -> 2 from #633 [1677880427560]

Judge has assessed an item in Issue 633 as 2 risk. The relevant finding follows: Vault contract implementation does not disable initializers The Vault.sol contract should implement disableInitializers in its constructure to prevent implementation contracts from being initialized. As this contract...

CVE-2023-26488: Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

Upgraded Q -> 2 from #356 [1677633435546]

Judge has assessed an item in Issue 356 as 2 risk. The relevant finding follows: L-01 ERC4626 does not work with fee-on-transfer tokens in project Impact ERC20 token contract can be deposited with the deposit function. With the following part of the code, the ERC20 transfer from msg.sender to the...