Dust Token Balances Cannot Be Claimed By An admin Account

Handle leastwood Vulnerability details Impact Users who have a small claim on rewards for various promotions, may not feasibly be able to claim these rewards as gas costs could outweigh the sum they receive in return. Hence, it is likely that a dust balance accrues overtime for tokens allocated f...

Malicious Promotion Creators Can Drain Token Balances

Handle leastwood Vulnerability details Impact The createPromotion allows any user to create and fund promotions for a specific number of epochs. Ticket holders are entitled to a percentage of the rewards based on their TWAB. createPromotion references a ticket address which can be controlled by t...

AaveVault is vulnerable to flashloan sandwich attack

Handle WatchPug Vulnerability details In the current implementation of AaveVault, tvl is only updated after each deposit/withdraw, which means unclaimed yields won't be included in tvl until someone deposit/withdraw, making it vulnerable to flashloan sandwich attack that steals pending yields. Po...

Slippage checks when adding liquidity are too strict

Handle cmichel Vulnerability details When adding liquidity through UniswapHandler.addLiquidity, the entire contract balances are used to add liquidity and the min amounts are set to 95% of these balances. If the balances in this contract are unbalanced the ratio is not similar to the current...

The design of wibBTC is not fully compatible with the current Curve StableSwap pool

Handle WatchPug Vulnerability details Per the documentation, wibBTC is designed for a Curve StableSwap pool. However, the design of wibBTC makes the balances change dynamically and automatically. This is unusual for an ERC20 token, and it's not fully compatible with the current Curve StableSwap...

Fee on transfer tokens do not work within the protocol

Handle tensors Vulnerability details Fee on transfer tokens transfer less tokens in than what would be expect. This means that the protocol request incorrect amounts when dealing with these tokens. The protocol should use stored token balances instead of transfer for calculating amounts. --- The...

Incompatibility With Rebasing/Deflationary/Inflationary tokens

Handle 0xRajeev Vulnerability details Impact WildCredit allows the permissionless listing of any ERC20 assets/pairs to be used in the protocol. Some of these tokens could charge a fee, add a reward or rebase over time. However, the protocol does not have the required support to handle such tokens...

Test configuration carryover to production deployment limits pool users to 5

Handle 0xRajeev Vulnerability details Impact The project uses a data structure for indexing ticket tokens/users called SortitionSumTreeFactory which as explained in the overview video time 14:20-14:50 is used to capture users’ token balances in the leaves where internal nodes represent their sums...

Incompatability with deflationary / fee-on-transfer tokens

Handle cmichel Vulnerability details Vulnerability Details The DInterest.deposit function takes a depositAmount parameter but this parameter is not the actual transferred amount for fee-on-transfer / deflationary or other rebasing tokens. Impact The actual deposited amount might be lower than the...

Reentrancy Attack

openzeppelin-solidity is vulnerable to reentrancy attack. The vulnerability exists when a extend custom beforeTokenTransfer is invoked when burning tokens and before the send hook is externally called on the sender while token balances are adjusted after the process and this may cause the...

TCash Number Error Vulnerability

TCash is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in TCash's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

CorelliCoin Digital Error Vulnerability

CorelliCoin is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in CorelliCoin's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

Carrot Number Error Vulnerability

Carrot is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in Carrot's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

QRG Number Error Vulnerability

QRG is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in QRG's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

Coinquer Digital Error Vulnerability

Coinquer is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in Coinquer's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

ZToken Number Error Vulnerability

ZToken is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in ZToken's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

YLCToken Number Error Vulnerability

YLCToken is an ethereum-based digital currency. An integer overflow vulnerability exists in the 'mintToken' function in YLCToken's smart contract implementation. An attacker can exploit this vulnerability to set the balance of any user to an arbitrary value...

CVE-2020-12119

Ledger Live before 2.7.0 does not handle Bitcoin's Replace-By-Fee RBF. It increases the user's balance with the value of an unconfirmed transaction as soon as it is received before the transaction is confirmed and does not decrease the balance when it is canceled. As a result, users are exposed t...

SHARKTECH Digital Error Vulnerability

SHARKTECH SKT is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'batchTransfer' function in SKT. An attacker can exploit this vulnerability to set the balance of an arbitrary user...

Aditus Security Vulnerabilities

Aditus ADI is an ethereum-based digital currency.A security vulnerability exists in the 'approveAndCall' function in ADI's smart contract implementation. The vulnerability can be exploited by an attacker to steal assets e.g., transfer all contract balances to the attacker's account...