HIGH: ETH is forever locked in GiantMevAndFeesPool due to unaccepted burn()

Lines of code Vulnerability details Description GiantMevAndFeesPools and StakingFundsVault implement beforeTokenTransfer transfer hooks. StakingFundsVault.sol: function beforeTokenTransferaddress from, address to, uint256 external override address syndicate = liquidStakingNetworkManager.syndicate...

Unbounded loop can run out of gas in withdraw and unstake operations

Lines of code Vulnerability details Unbounded loop can run out of gas in withdraw and unstake operations Impact There are no bounds on the number of orders in the loop, this can run out of gas due to cost of the operations that can vary by the time. Proof Of Concept function withdrawLPTokensLPTok...

Theft of ETH that was not used for the successful execution of orders

Lines of code Vulnerability details Description There are execute and bulkExecute functions in Exchange smart contract. There is the refund of any ETH that was unused for example that was left due to the unsuccessful order execution at the end of its execution flow: returnDust; returnDust functio...

Tx should revert when the call in _returnDust failed

Lines of code Vulnerability details Impact User may lose remaining ETH of the transaction Proof of Concept As the returned status of the call in returnDust is ignored, the tx will success even if the call failed, which means the caller does not get his ETH back. Tools Used n/a Recommended...

Theft of ETH that was not used for successful execution of orders in non-atomic execution

Lines of code Vulnerability details Description There is an execute function in LooksRareAggregator contract. It refunds any ETH that was unused for example that left due to the unsuccessful execution of an order at the end of its execution flow: returnETHIfAnyoriginator; returnETHIfAny function ...

Tokens and ETH can be sweeped from LooksRareAggregator

Lines of code Vulnerability details Impact Tokens and ETH can be sweeped from LooksRareAggregator Proof of Concept A malicious user may transfer out any tokens or ETH that are owned by LooksRareAggregator. To do so, a such user has to call execute - and make the trade. After executing of order...

Loss of user funds

Lines of code Vulnerability details Impact The LooksRareAggregator contract can receive ether but cannot return it unless through the returnERC20TokensIfAny or returnETHIfAny function. This means that there is a scenario where a user can accidentally transfer funds to this contract and those fund...

ERC20 and ETH might be returned back to the wrong originator

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Assume the address of erc20EnabledLooksRareAggregator was maliciously changed to fakeerc20EnabledLooksRareAggregator during an execution of LooksRareAggregator.execute then, the malicious user might for...

BLOCK_PERIOD is incorrect

Lines of code Vulnerability details The BLOCKPERIOD is set to 13 seconds in Config.sol. uint256 constant BLOCKPERIOD = 13 seconds; Since moving to Proof-of-Stake PoS after the Merge, block times on ethereum are fixed at 12 seconds per block slots. . Impact This results in incorrect calculation of...

Lack of notice period for critical operations

Lines of code Vulnerability details Impact All user assets can be locked or stolen. Proof of Concept All user assets can be locked or stolen if the L1ERC20Bridge or L1EthBridge is upgraded to a malicious contract. All user assets can be locked or stolen if governor is lost and...

ergs price problem

Lines of code Vulnerability details No mechanism has been defined for " l2TransactionBaseCost" function. On the other hand, any Oracle is not used in the whole project to get the price of gas, so this whole project will suffer in coordinating between the price of “ergs” in ZK layer and the real a...

Unchecked array length of the public_inputs[] in Verifier.sol

Lines of code Vulnerability details Impact If an array enumerates all registered addresses, an adversary can register many addresses, causing the problem described above. Vulnerability Details Ethereum is a very resource-constrained environment. Prices per computational step are orders of magnitu...

Unchecked array lenght

Lines of code Vulnerability details Impact If an array enumerates all registered addresses, an adversary can register many addresses, causing the problem described above. Description Ethereum is a very resource-constrained environment. Prices per computational step are orders of magnitude higher...

CVE-2022-39354

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...

Design/Logic Flaw

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...

RUSTSEC-2022-0083 evm incorrect state transition

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...

evm incorrect state transition

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...

CVE-2022-39354 evm has incorrect is_static parameter for custom stateful precompiles

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...

Signature replay attacks

Lines of code Vulnerability details Description There is a function deployHolographableContract from the HolographFactory smart contract. Among other things, the function verifies the ECDSA signature. The signed data for verification is constructed as a concatenation of different user-provided...

Risk of reuse of signatures across forks due to lack of chainID validation

Lines of code Vulnerability details Impact In the HolographERC20.sol contract the contract is started with the init function, during which the eip712init function is triggered : contracts/enforcer/HolographERC20.sol: 244: eip712initdomainSeperator, domainVersion; With CACHEDCHAINID = block.chaini...