CrossChainExecutorPolygon does not implement the executeCalls function

Lines of code Vulnerability details Impact The CrossChainExecutor contracts in the codebase are meant to follow the CrossChainExecutor interface as defined in EIP-5164. Each L2 network specific CrossChainExecutor contract is also expected to inherit and follow the ICrossChainExecutor interface...

Missing msg.value when executing the cross-chain request

Lines of code Vulnerability details Impact the cross-chain request will not support smart contract that requires ETH payment in destination chain on execution side. Proof of Concept When a user relayers call and performs a cross-chain request, the executor needs to execute the request in the...

setRelayer function not checking for null relayer address

Lines of code Vulnerability details Summary When calling the setRelayer function with a null relayer address, the function does not check for this and allows the address to be set. This issue can cause the contract to fail when calling the executeCalls function and potentially cause loss of funds...

Upgraded Q -> M from #38 [1670234424045]

Judge has assessed an item in Issue 38 as M risk. The relevant finding follows: L2. Pool selection for the compound is not restricted Compound function of AutoPxGmx contract is public and available for everyone. An attacker can create a custom pool with a higher fee value currently, on tests it...

Potential security issues in CrossChainExecutorOptimism contract

Lines of code Vulnerability details Title: Potential security issues in CrossChainExecutorOptimism contract Product: CrossChainExecutorOptimism contract Version: 0.8.16 Summary: The CrossChainExecutorOptimism contract contains several potential security issues that could allow unauthorized or...

Upgraded Q -> M from #400 [1670235895275]

Judge has assessed an item in Issue 400 as M risk. The relevant finding follows: L01 - EOA restriction of wallet representative can be bypassed A node operator can call registerBLSPublicKeys to register a node runner to LSD and create a new smart wallet. The protocol only allows EOAs to be...

Incorrect behavior in CrossChainExecutorPolygon contract

Lines of code Vulnerability details Description: We have discovered an issue with the CrossChainExecutorPolygon contract. When a message with a nonce that has already been executed is received, the contract does not prevent the message from being processed or display an error message. This issue...

Incorrect use of AddressAliasHelper.applyL1ToL2Alias() in _isAuthorized()

Lines of code Vulnerability details Summary In the isAuthorized function, the require statement checks if the msg.sender is equal to the result of calling AddressAliasHelper.applyL1ToL2Alias with relayer as the argument. However, this is incorrect, as AddressAliasHelper.applyL1ToL2Alias is intend...

Fail to verify the result of a low level function call

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. It fails to check properly if the call is successful because: 1 It does not check the return data; 2 it does not check if the target address is a valid contract. A contract that has no code will still...

Upgraded Q -> M from #373 [1670018401792]

Judge has assessed an item in Issue 373 as M risk. The relevant finding follows: N2. ETH not accumulated in previewAccumulatedETH supposed to have accumulated += ... Although it is an external view function, depending on its usages, it may present more issues to the callers. --- The text was...

Upgraded Q -> M from #205 [1669936745167]

Judge has assessed an item in Issue 205 as M risk. The relevant finding follows: L01 - No check if EOARepresentative or EOARepresentativeOfNodeRunner is an EOA or a smart contract Impact A smart contract can end up being assigned as a smartWalletRepresentative. Such smart contract might not have...

Compounding is vulnerable to sandwich attack

Lines of code Vulnerability details Impact Function compound is called in every deposit/withdraw in AutoPxGmx contract. It claim rewards in form of gmxBaseReward and swap them to gmx token. They used amountOutMinimum from input params gmxAmountOut = SWAPROUTER.exactInputSingle...

fee distribution is only for the msg.to contract, instead of the to address of the call traces, which is not reasonable for the gas economic system.

Lines of code Vulnerability details Impact The target contract of the fee distribution is got by contract := msg.To in the evmhooks.go . So the fee distribution is only for the msg.to contract, instead of the to address of the call traces. It means that any one use a contract wallet or setup a...

Division by zero could cause DOS in function harvest() and claim() in PirexRewards contract

Lines of code Vulnerability details Impact When functions harvest or claim of PirexRewards are called, they will claim rewards by calling PirexGmx.claimRewards function. If there is any case that esGmx reward is existed but not base rewards or vice versa, the value returned from calculateRewards ...

user fund lose in deposit() of PirexERC4626 contract because A MALICIOUS EARLY USER/ATTACKER CAN MANIPULATE THE VAULT’S PRICEPERSHARE TO TAKE AN UNFAIR SHARE OF FUTURE USERS’ DEPOSITS

Lines of code Vulnerability details Impact This is a well-known attack vector for new contracts that utilize pricePerShare for accounting. Attacker can cause totalAssets / totalSupply ratio to go as high as he wants and then because of rounding error in convertToShares lower amount of share would...

First depositor who is a whale account can deny later depositors who are smaller accounts from using AutoPxGmx contract, such as for depositing GMX for apxGMX

Lines of code Vulnerability details Impact A whale account that owns a lot of GMX can call the following PirexGmx.depositGmx function to deposit much GMX for pxGMX. As the first depositor for the AutoPxGmx contract, this account can then call the AutoPxGmx.depositGmx function to deposit 1 wei GMX...

lack of unregiestered function existen

Lines of code Vulnerability details there is no function to let a smart contract to unregester from a tokenid , since a smart contract can only be regestered once its highly recommended to give it an ability to unregister from a tokenid and register again bob calls register bob has two...

isContract might return false for the contracts

Lines of code Vulnerability details Impact The Turnstile contract's register function assumes the msg.sender is a smart contract. The validation of this is carried out in eventhandler.go's ValidateContract function. ValidateContract checks whether the address has an emptyCodeHash which is zero...

Existing tokens can be given to other contracts when assign function is called

Lines of code Vulnerability details Impact In the Turnstile contract when the assign function is called any unregistered contract can register himself as the feeRecipient for any given token id, but in reality only the token owner should be able to assign a new smart contract as feeRecipient for...

The recipient address check during handling register events will confuse users and block the users contracts registering

Lines of code Vulnerability details Impact The check about if the receiver account exists in the evm store doesn't make sense and will cause users to encounter a confusing exception. And the RegisterEvent function will not throw an exception to revert the tx, the source contract will be wrote in...