Loss of airdropped Token or NFT in NFT Bridge

Lines of code Vulnerability details Impact Loss of airdropped Token or NFT in NFT Bridge and Token Bridge Proof of Concept Contract L1ERC721Bridge is for bridging NFTs from L1 to L2 and it holds all the bridged NFTs. Most of the NFT projects would airdrop new NFTs for previous owners or drop ERC2...

Users can bypass distributions fees by ragequitting instead of using a formal distribution

Lines of code Vulnerability details Impact Distribution fees can be bypassed by ragequitting instead of distributing Proof of Concept address payable feeRecipient = feeRecipient; uint16 feeBps = feeBps; if tokenType == ITokenDistributor.TokenType.Native return distributor.createNativeDistribution...

Mutexes can be tampered with to increase gas costs

Lines of code Vulnerability details Impact An attacker can set mintedAmount and reservedRate to 0 which incurs greater gas fees when calling payParams. In the worst case this might cause the transaction to revert if the gas limit was tightly set to the expected gas cost. Proof of Concept...

Malicious actor can win auction unfavorably to the protocol by block stuffing

Lines of code Vulnerability details Vulnerability Details When protocol’s bad debt is auctioned off with 10% incentive at the beginning. A user who gives the best bid, wins. The auction ends when at least one account placed a bid, and current block number is bigger than nextBidderBlockLimit:...

Upgraded Q -> 2 from #215 [1683053585771]

Judge has assessed an item in Issue 215 as 2 risk. The relevant finding follows: QA10 Both EthRouterbuy and EthRoutersell do not check whether recipient == address0, as a result, they might send royalty fees to the zero address - loss of funds. --- The text was updated successfully, but these...

High Gas Costs Due to Unnecessary String Iteration in HexUtils Library's hexStringToBytes32() Function.

Lines of code Vulnerability details Impact The hexStringToBytes32 function in the HexUtils library iterates over the entire input string, even though only a portion of it is needed to compute the output, but still, this can lead to unnecessarily high gas costs, especially for large input strings...

There is no way to withdraw the Fees from the reserve contract

Lines of code Vulnerability details Impact This will mean 1000 of dollars worth of ZCHF in fees cannot be withdrawn by the owner Proof of Concept The reserve contract currentlyor can be the frankencoin contract also lacks a function for withdrawing ZCHF tokens, which are deposited as fees when...

Let Me Suggest For You

Lines of code Vulnerability details Impact Scope of vulnerabiliy - This vulnerability allows any user including users the do not own any share tokens to effectivly cast a veto on a minter suggetion. The only requirement to excecute the vulnerability is to have the minimun fee in the acccount. In...

ETHCrowdfundBase.sol: totalVotingPower is increased too much in the _finalize function

Lines of code Vulnerability details Impact This issue is about how the ETHCrowdfundBase.finalize functions calls PartyGovernanceNFT.increaseTotalVotingPower with an amount that does not reflect the sum of the individual users' voting power. Thereby it will become impossible to reach unanimous...

Amplifier users might not get all the LP fees they are entitled to

Lines of code Vulnerability details Proof of Concept Observe that there is only one place that the amplifier is calling claimFees, and it's inside an if statement of the update modifier, requiring mostRecentValueCalcTime modifier update if mostRecentValueCalcTime == 0 mostRecentValueCalcTime =...

User should be able to set the slippage amount willing to pay

Lines of code Vulnerability details Impact The impact of this finding is that users may be required to pay higher transaction fees than necessary due to the absence of an adjustable slippage feature. This could discourage users from using the SafEth contract and negatively impact its adoption...

Upgraded Q -> 2 from #39 [1679850456945]

Judge has assessed an item in Issue 39 as 2 risk. The relevant finding follows: N-05 Fees are not being set in the constructor --- The text was updated successfully, but these errors were encountered: All reactions...

Default accounts cannot pay transaction fees due to DefaultAccount not calling MsgValueSimulator

Lines of code Vulnerability details Impact Default accounts cannot pay the transaction fees to the bootloader. It's not clear whether the attempts to do so will silently succeed or revert because the behaviour of the CALL opcode in the zkSync Era virtual machine isn't explained in the description...

The "totalRequiredBalance()" function in the TransactionHelper.sol library can compute address(uint160(_transaction.paymaster) as zero address even when _transaction.paymaster is non-zero

Lines of code Vulnerability details Impact A user may provide a non-zero entry for the "transaction.paymaster" field for a transaction to ensure they do not have to pay the gas fees. However, certain values of "transaction.paymaster" = 2^160 can result in addressuint160transaction.paymaster to be...

Everything wrong with deposit method

Lines of code Vulnerability details Impact No Accounting, Wrong data in Event emission in case of Fees on transfer Tokens and limited usecase. Proof of Concept File: DAO.sol function deposit address token, uint256 amount, string calldata reference external payable override if amount == 0 revert...

Redemption fee increase can be thwarted

Lines of code Vulnerability details Impact The mechanism to increase the baseRate during redemptions is moot, up to gas fees. Therefore an arbitrageur can redeem more than what is healthy for the supply of LUSD. This weakens the price floor at $1, and may cause needless volatility. It further...

First staker staking can lead to unfair profiting

Lines of code Vulnerability details Impact A caller is able to drain all of the fees from the pool if the caller stakes prior to totalLQTYStaked, in the LQTYStaking contract, being greater than 0. When the protocol is first deployed, FLUSD is zero. It is increased when troves are opened. If a...

Upgraded Q -> 2 from #664 [1677633674294]

Judge has assessed an item in Issue 664 as 2 risk. The relevant finding follows: 2- Vault fees can be set greater than 1e18 in the initialize function : The Vaut contract implements 4 types of fees deposit, withdrawal, management, performance collected when the user deposits or withdraw tokens,...

Upgraded Q -> 2 from #56 [1677632875022]

Judge has assessed an item in Issue 56 as 2 risk. The relevant finding follows: 2. Attribute values of fees could exceed 1e18 when initializing even if the proposedFees is checked in proposeFees function. function initialize IERC20 asset, IERC4626 adapter, VaultFees calldata fees, address...

AdapterBase.accruedPerformanceFee does not work with tokens with low decimals

Lines of code Vulnerability details The performance fees are only accrued when shareValue highWaterMark. 529: function accruedPerformanceFee public view returns uint256 530: uint256 highWaterMark = highWaterMark; 531: uint256 shareValue = convertToAssets1e18; //@audit M: this does not work for...