VaultHelper deposits don't work with fee-on transfer tokens

Handle cmichel Vulnerability details There are ERC20 tokens that may make certain customizations to their ERC20 contracts. One type of these tokens is deflationary tokens that charge a certain fee for every transfer or transferFrom. Others are rebasing tokens that increase in value over time like...

Possibility to Stake Twice

Handle verifyfirst Vulnerability details Impact Potential for some users to double-stake their Yaxis. Proof of Concept // SPDX-License-Identifier: MIT pragma solidity 0.6.12; import "@openzeppelin/contracts/token/ERC20/ERC20.sol"; import "@openzeppelin/contracts/token/ERC20/SafeERC20.sol"; // yAx...

nTokenAction does not emit Approval events

Handle cmichel Vulnerability details Vulnerability Details The nTokenAction is supposed to mimic the ERC20 but the allowance changes do not emit the Approval event in nTokenTransferFrom. Impact Off-chain scripts will have the wrong allowance value as it's tracked in nTokenTransferApproveAll but t...

CompoundToNotionalV2.notionalCallback ERC20 return values not checked

Handle cmichel Vulnerability details Vulnerability Details Some tokens like USDT don't correctly implement the EIP20 standard and their transfer/transferFrom function return void instead of a success boolean. Calling these functions with the correct EIP20 function signatures will always revert. S...

CompoundToNotionalV2.enableToken ERC20 missing return value check

Handle cmichel Vulnerability details Vulnerability Details The enableToken function performs an ERC20.approve call but does not check the success return value. Some tokens do not revert if the approval failed but return false instead. Impact Tokens that don't actually perform the approve and retu...

TokenHandler.setToken ERC20 missing return value check

Handle cmichel Vulnerability details Vulnerability Details The setToken function performs an ERC20.approve call but does not check the success return value. Some tokens do not revert if the approval failed but return false instead. Impact Tokens that don't actually perform the approve and return...

Freeze The Bridge Via Large ERC20 Names/Symbols/Denoms

Handle nascent Vulnerability details Ethereum Oracles watch for events on the Gravity.sol contract on the Ethereum blockchain. This is performed in the checkforevents function, ran in the ethoraclemainloop. In this function, there is the following code snippet: let erc20deployed = web3...

ERC20s that block transfer to particular addresses enable DoS/Censorship

Handle nascent Vulnerability details Tokens that prevent transfers to particular addresses most commonly address0 as is the OpenZeppelin standard enables DoS against a batch. If the attacker submits the bad transaction, the relayer wont submit the batch. The attacker never has to worry about the...

Reentrancy Bug in TimelockController.sol

Handle leastwood Vulnerability details Impact Notional's governance framework utilises a fork of Compound's Governor Alpha and ERC20 token. These are denoted specifically as the GovernorAlpha.sol and NoteERC20.sol contracts. However, the GovernorAlpha.sol has a key difference when compared to...

@hyperledger/cactus-example-carbon-accounting-backend (>=0.5.0-alpha.0, <=0.8.0), @leap-network/pooltogether-proxy-factory (1.0.0-beta.2) +31 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=3.4.0, <=3.4.1)

@openzeppelin/contracts-upgradeable NPM version =3.4.0, =0.5.0-alpha.0, =1.0.0, =1.0.0-beta.1, =0.7.12, =0.3.0, =0.1.0, =0.4.0, =0.7.12, =0.7.12, =0.0.1, =0.7.7, =0.8.18 and more Source cves: CVE-2021-39168 Source advisory: OSV:GHSA-VRW4-W73R-6MM8...

@biconomy/hyphen-contracts (1.0.4), @hifi/amm (>=1.1.2, <=1.4.0) +7 more potentially affected by CVE-2021-39168 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.3.0)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0, =2.3.2 Source cves: CVE-2021-39168 Source advisory: OSV:GHSA-VRW4-W73R-6MM8...

@avalabs/avalanche-wallet-sdk (>=0.3.0, <=0.9.4), @b0dhidharma/contract-utils (0.1.1) +49 more potentially affected by CVE-2021-39167 via @openzeppelin/contracts (>=4.0.0, <=4.3.0)

@openzeppelin/contracts NPM version =4.0.0, =0.3.0, =0.0.2, =1.0.0, =1.1.0, =2.0.0-alpha.0, =0.1.1, =0.0.1, =3.0.0-alpha.2, =3.0.0-alpha.1, =3.0.0-alpha.1, =3.0.0-alpha.1, =0.0.0-736762ba, =0.0.23-canary and more Source cves: CVE-2021-39167 Source advisory: OSV:GHSA-FG47-3C2X-M2WR...

Arbitrary Logic Enables ERC20 Theft

Handle ElliotFriedman Vulnerability details Severe Issue: ERC20 Token Theft Using Arbitrary Logic There are 2 ways that this bug can be used to drain funds from the bridge. Both are catastrophic and result in total loss of funds. The 1st method is horrible, the second method is diabolical as it c...

Deposits don't work with fee-on transfer tokens

Handle cmichel Vulnerability details There are ERC20 tokens that may make certain customizations to their ERC20 contracts. One type of these tokens is deflationary tokens that charge a certain fee for every transfer or transferFrom. Others are rebasing tokens that increase in value over time like...

Rewards accumaulated can stay constant and oftern not increment

Handle moose-code Vulnerability details Impact rewardsPerToken.accumulated can stay constant while rewardsPerToken.lastUpdated is continually updated, leading to no actual rewards being distributed. I.e. No rewards accumulate. Proof of Concept Line 115, rewardsPerToken.accumulated could stay...

Rewards squatting - setting rewards in different ERC20 tokens opens various economic attacks.

Handle moose-code Vulnerability details Impact Users have essentially have an option to either claim currently earned reward amounts on future rewards tokens, or the current rewards token. Although stated on line 84, it does not take into account the implications and lock in this contract will ha...

Use safeTransfer instead of transfer

Handle shw Vulnerability details Impact Tokens not compliant with the ERC20 specification could return false from the transfer function call to indicate the transfer fails, while the calling contract would not notice the failure if the return value is not checked. Checking the return value is a...

No ERC20 safe* versions called

Handle cmichel Vulnerability details The claim function performs an ERC20 transfer rewardsToken.transferto, claiming; but does not check the return value, nor does it work with all legacy tokens. Some tokens like USDT don't correctly implement the EIP20 standard and their transfer/transferFrom...

Use safeTransfer instead of transfer

Handle shw Vulnerability details Impact Tokens not compliant with the ERC20 specification could return false from the approve call to indicate the approval fails, while the calling contract would not notice the failure if the return value is not checked. Proof of Concept Referenced code:...

ERC20 return values not checked

Handle cmichel Vulnerability details The ERC20.transfer and ERC20.transferFrom functions return a boolean value indicating success. This parameter needs to be checked for success. Some tokens do not revert if the transfer failed but return false instead. The Staker.withdraw function does not chec...