No Revert on Failure, an order can be execute successfully by disguising them as NFTs.

Lines of code Vulnerability details Impact ERC20 tokens don't throw a error when failed in transfer. A malicious user can pretend to be sending an ERC721 token while it is something else. Orders are getting executed inside LooksRareProxy.sol, an attacker as a maker can make an BasicOrder that has...

Re-Entrancy when invoking ERC20EnabledLooksRareAggregator.execute() function

Lines of code Vulnerability details Impact We didn't check the address of currency . We don't know if the currency is ERC20 or not, and then just invoke currency.call. For these functions, we don't have any Re-Entrancy check. It will definitely lead to an Re-Entrancy issue on the currency side...

Unsafe usage of ERC20 transfer and transferFrom

Lines of code Vulnerability details Impact Some ERC20 tokens functions don’t return a boolean, for example, USDT, BNB, OMG. So the LowLevelERC20Transfer contract simply won’t work with tokens like that as the token. Proof of Concept USDT’s transfer and transferFrom functions don't return a bool,...

Upgraded Q -> M from #43 [1668210521611]

Judge has assessed an item in Issue 43 as M risk. The relevant finding follows: Q-02 - Huge trust assumption in recoverErc20 Reward tokens are transferred into this contract when a pledge is created. The comment notes " Recovers ERC2O tokens sent by mistake to the contract", but this function can...

ETH can be accidentally sent with ERC20 in sendOutTokenOrETH function

Lines of code Vulnerability details Impact ETH can be accidentally sent with ERC20 in sendOutTokenOrETH function User who wants to send ERC20 due to payable function can write a value in the value field Proof of Concept contracts/utils/LineLib.sol: 33 / 34: function sendOutTokenOrETH 35: address...

Logic in LineLib does not work correctly with fee-on-transfer tokens

Lines of code Vulnerability details Proof of Concept Some tokens take a transfer fee e.g. STA, PAXG, some do not currently charge a fee but may do so in the future e.g. USDT, USDC. The code currently receives ERC20 tokens but does not account for the potential fees paid in the transfer. If such a...

Potential DoS when closing a credit nominated in ETH in the LineOfCredit contract

Lines of code Vulnerability details When closing a credit that was issued in ETH, the LineOfCredit contract will send the lender his deposit and any accrued interests using the address.transferamount function, which may fail and revert the whole function, leading to an eventual DoS. Impact The...

SpigotedLineLib::trade won’t work with tokens with approval race protection (USDT)

Lines of code Vulnerability details Proof of Concept Some tokens e.g. USDT, KNC do not allow approving an amount M 0 when an existing amount N 0 is already approved. This is to protect from an ERC20 attack vector described here. The problem is the code in trade is the following...

LineLib.sendOutTokenOrETH() may not be compatible with contract receiver because of use of transfer()

Lines of code Vulnerability details Impact LineLib.sendOutTokenOrETH may revert when its receiver is a contract, preventing it from receiving ETH, and thus from much of the functionality of the protocol. Proof of Concept LineLib.sendOutTokenOrETH is as follows. / @notice - Send ETH or ERC20 token...

Missing ReEntrancy Guard to sendOutTokenOrETH function

Lines of code Vulnerability details Proof of Concept There is no re-entry risk on true ERC-20 tokens that work according to the spec i.e. audited, etc.. However you can write a malicious ERC-20 with custom transferFrom or approve that have re-entrancy hooks to attack a target. Furthermore ERC-777...

Not checking amount of received ERC20 tokens

Lines of code Vulnerability details Description There are ERC20 tokens, which apply intenal fee on transfers such as USDT, so that amount of received tokens could differ from requested amount. There is a line where contract receives facilityFee as an amount of tokens. The same variable is used on...

ERC20 and ETH might be returned back to the wrong originator

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Assume the address of erc20EnabledLooksRareAggregator was maliciously changed to fakeerc20EnabledLooksRareAggregator during an execution of LooksRareAggregator.execute then, the malicious user might for...

VARIABLE BALANCE TOKEN ASSOCIATED WITH LOSS AND LOCKING OF FUNDS

Lines of code Vulnerability details Impact ERC20 tokens that are either deflationary or re-basing down could have their respective balance change. The balance could become insufficient at the time of withdraw, refund or cancel to the bidders whose funds will be locked due to DOS. The way to take...

Reentrancy in createAuction() function

Lines of code Vulnerability details Impact Some ERC20 tokens missing return values and don't fail in case of an unsuccessful transfer. Also, ERC777 tokens could call the tokens receivers during the transfer. If baseToken would be such a token that combines both properties - this could lead to a...

baseToken AND quoteToken CAN BE THE SAME ERC20 TOKENS, RESULTING IN TRICKING BIDDERS TO LOSE THEIR TOKENS

Lines of code Vulnerability details Impact createAuction can be called by anyone to create auctions. One of the input parameter that this function requires is auctionParams. Since the createAuction function doesn't check that baseToken AND quoteToken are same or not, an Adversary can create an...

msg.sender token balance is not checked before calling safeTransferFrom function

Lines of code Vulnerability details Impact createAuction FUNCTION and bid FUNCTION: Without checking the msg.sender token balance the transfer function may be failed to transfer token from msg.sender to contract address . this may cause a transactions failures. Same instance in 2 times PROOF OF...

Hacker can front-run the L2 ERC20 token deployment.

Lines of code Vulnerability details Impact hacker can front-run the L2 ERC20 token deployment to block L2 ERC20 token finalizeDeposit Proof of Concept I intend to prove this piece of code is front-runnable by hacker: /// @notice Finalize the deposit and mint funds /// @param l1Sender The account...

Bridge should not allow ERC20 tokens with double-entry point

Lines of code Vulnerability details Impact If a token with double-entry point is escrowed in L1 bridge, the user could withdraw their token through the other entry point, thus rugpulling the bridge. And when they actually withdraw from L2, they will take other users' funds from the bridge. Proof ...

Pledge creator can extend pledge without paying in edge cases.

Lines of code Vulnerability details Impact Pledge creator can extend pledge without paying in edge cases. Proof of Concept When pledge creators wants to extend their pledges, they must transfer an additional reward amount and fee: uint256 totalRewardAmount = pledgeParams.rewardPerVote...

The pledge creators might lose all of their funds by recoverERC20().

Lines of code Vulnerability details Impact There is a recoverERC20 function to withdraw ERC20 tokens from the contract. Currently, it checks if the token isn't an active reward token but it can be passed easily if the admin removes the reward token using removeRewardToken. So if the admin removes...