Fee-on-transfer support

Lines of code Vulnerability details Impact Every time transferFrom or transfer function in ERC20 standard is called there is a possibility that underlying smart contract did not transfer the exact amount entered. It is required to find out contract balance increase/de...

Fee-on-transfer support

Lines of code Vulnerability details Impact Every time transferFrom or transfer function in ERC20 standard is called there is a possibility that underlying smart contract did not transfer the exact amount entered. It is required to find out contract balance increase/decrease after the transfer to...

Upgraded Q -> M from 47 [1655572104366]

Judge has assessed an item in Issue 47 as Medium risk. The relevant finding follows: 1. Unsafe use of transfer/transferFrom with IERC20 Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's transfer and...

Approve Returned Value Not Validated

Lines of code Vulnerability details Proof-of-Concept The approve function attempts to performs an ERC20.approve call, but does not check if the returned value is true Succeed or false Failed. Some tokens do not revert if the approval failed but return false instead. / @dev Approve the given...

Unchecked return value for ERC20.approve call

Lines of code Vulnerability details Impact Tokens that don't actually perform the approve and return false are still counted as a correct approve. Proof of Concept In NotionalTradeModule.sol, there is approve function which makes a low level call but does not check the success return value. Some...

NotionalTradeModule._approve() function is missing return value check.

Lines of code Vulnerability details Impact NotionalTradeModule.mintFCashPosition wouldn't work properly when approve function fails to approve without reverting. Proof of Concept This approve function performs an ERC20.approve call but does not check the success return value. Some tokens do not...

Users cannot initialize() a proxy with a currencyId with a different maturity

Lines of code Vulnerability details The wfCashBase.initialize sets the allowance for NotionalV2 to the assetToken and underlyingToken to the maximum using SafeApprove. However, according to , SafeApprove function requires that the current approval is 0 before setting the new one. Therefore, if a...

Loss of tokens due to wrong burn function

Lines of code Vulnerability details Impact redeemToUnderlying is also affected by the issue I reported earlier which is described below. The redeem function calls burn which is inherited from IERC777Upgradeable contract whose action is to burn ERC20 tokens, thus there is no transfer or withdrawal...

Upgraded Q -> M from 95 [1654474439349]

Judge has assessed an item in Issue 95 as Medium risk. The relevant finding follows: Incompatability with deflationary / fee-on-transfer tokens Function Cally.createVault function takes a tokenIdOrAmount parameter but this parameter is not the actual transferred amount for fee-on-transfer /...

Upgraded Q -> M from 74 [1654474884998]

Judge has assessed an item in Issue 74 as Medium risk. The relevant finding follows: Protocol does not support fee-on-transfer tokens The tokenIdOrAmount established in createVault prevents buyers from exercise their option because addressthis holds less than tokenIdOrAmount due to the transfer...

Upgraded Q -> M from 104 [1654443194486]

Judge has assessed an item in Issue 104 as Medium risk. The relevant finding follows: transfer return value of a general ERC20 is ignored Need to use safeTransfer instead of transfer. As there are popular tokens, such as USDT that transfer/trasnferFrom method doesn’t return anything. The transfer...

Upgraded Q -> M from 137 [1654449389324]

Judge has assessed an item in Issue 137 as Medium risk. The relevant finding follows: It does not even check the return value and a low-level call succeeds if the address is empty or non-existent. dexMapping is a manually operated config so it may not contain info for all collateral tokens, and i...

Compromised Channel Can Compromise ALL NFTs and Tokens

Lines of code Vulnerability details Impact The contest IN SCOPE section clearly states that offer items can only be transferred by a conduit that only has Seaport set as a channel. However, this condition is not true. If a compromised channel is added to a conduit, then ALL the NFTs and tokens th...

_transfer#Executor.sol not checking all enum values

Lines of code Vulnerability details Impact Transaction can revert or have unexpected behaviour Poc In transferexecutor.sol you are checking Itemtype values Itemtype.NATIVE, Itemtype.ERC20 and Itemtype.ERC721 after then the last else clause assumes that the Itemtype is a ERC1155. else @audit assum...

Can avoid paying for additional recipients' consideration items due to out of bounds read for additionalRecipients

Lines of code Vulnerability details Impact The assertConsiderationLengthIsNotLessThanOriginalConsiderationLength call is off-by-one for the parameters.additionalRecipients.length + 1. // requires parameters.additionalRecipients.length + 1 = parameters.totalOriginalAdditionalRecipients...

in VeAssetDepositor and Booster contract don't set safeApprove() to 0 first and that token uses OpenZeppelin’s ERC20 implementation

Lines of code Vulnerability details Impact OpenZeppelin’s implementation of safeApprove won't work if approved amount is not set to 0. so the logics will fail if code don't set it 0 first. Both VeToken and VE3Token use OpenZeppelin’s ERC20 implementation and VeAssetDepositor and Booster calls...

deposit function of VeAssetDepositor.sol will be failed if stakeAddress is set.

Lines of code Vulnerability details Impact Wrong contract variable is used, so transaction cannot be executed. Proof of Concept This line is trying to call ERC20 function from minter contract. The minter is not ERC20 token, and does not have safeApprove function. So this will revert transaction...

Non standard token transfers will fail in the protocol

Lines of code Vulnerability details Impact In TokenTransferrer.sol the performERC20Transfer function handles the transfer of ERC20 tokens in the protocol. It uses the ERC20transferFromsignature constant inherited from TokenTransferrerConstants.sol. The problem is that tokens that don’t correctly...

Bribe.sol Tokens with fee on transfer are not supported

Lines of code Vulnerability details There are ERC20 tokens that charge fee for every transfer or transferFrom. In the current implementation, Bribe.solnotifyRewardAmount assumes that the received amount is the same as the transfer amount, and uses it to calculate reward amounts. As a result, in...

notifyRewardAmount() griefing attack by adding MAX_REWARD_TOKENS

Lines of code Vulnerability details function notifyRewardAmountaddress token, uint amount external lock requireamount 0; if !isRewardtoken requirerewards.length Recommendation Consid...