Drainage of FeeCollector's Block Transaction Fees in cronos

Impact In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx. User funds and balances are safe. Patches This problem has been patched in Cronos v0.6.5 on the mempool...

Unused WJLP can't be simply unwrapped

Handle kenzo Vulnerability details WJLP can only be unwrapped from the Active Pool or Stability Pool. A user who decided to wrap his JLP, but not use all of them in a trove, Wouldn't be able to just unwrap them. Impact Impaired functionality for users. Would have to incur fees for simple...

Minting and burning synths exposes users to unlimited slippage

Handle TomFrenchBlockchain Vulnerability details Impact LPs remaining in VaderPool end up paying all transfer fees for LPs which leave the pool. Proof of Concept See VaderPoolV2.mintSynth: Here a user sends nativeDeposit to the pool and the equivalent amount of foreignAsset is minted as a synth t...

Cronos 安全漏洞

Cronos is a Crypto.org Evm chain. Designed to massively scale the DeFi ecosystem. Cronos suffers from a security vulnerability that stems from the fact that in Cronos nodes running versions prior to v0.6.5, it is possible to collect transaction fees for the current block from the Cosmos SDK's...

The return value of the _sendForReceiver function is not set, causing the receiver to receive more fees

Handle cccz Vulnerability details Impact In the NFTXSimpleFeeDistributor.sol contract, the distribute function is used to distribute the fee, and the distribute function judges whether the fee is sent successfully according to the return value of the sendForReceiver function. function...

No access control on assignFees() function in NFTXVaultFactoryUpgradeable contract

Handle ych18 Vulnerability details In If the Vault owner decides to set factoryMintFee and factoryRandomRedeemFee to zero, any user could call the function NFTXVaultFactoryUpgradeable.assignFees and hence all the fees are updated. --- The text was updated successfully, but these errors were...

TwabRewards: cancelPromotion() can revert if a promotion tokens applies fee on transfer

Handle GiveMeTestEther Vulnerability details Impact If the promotion token applies transfer fees, the total amount the contract holds will be less than "tokensPerEpoch numberOfEpochs" bcs a part of this amount is the fee = funds + fee, but only the "funds" can be withdrawn. If after each epoch al...

TwabRewards: fee on transfer token as promotion token can make claimRewards() & cancelPromotion() fail

Handle GiveMeTestEther Vulnerability details Vulnerability details Impact If the rewards creator sets a token that applies transfer fees for the promotion token, users won't be able to claim some of their rewards because the claimRewards uses calculateRewardAmount that assumes for each epoch ther...

Basket:handleFees(): fees are overcharged

Handle GiveMeTestEther Vulnerability details Impact The fee calculation is based on the totalSupply of the basket token. But some amount of the totalSupply represents the fees paid to the publisher/ protocol owner. Therefore the fees are "overcharged": because the fee amount is calculated on a pa...

Publisher can scam users by changing license fees and using auction to freeze user funds

Handle 0x0x0x Vulnerability details Publisher can call changeLicenseFee to change fees. There is no maximum cap for this parameter. At first glance, because there is a timelock period of 1 day, the users have enough time to react. But if the publisher can start an auction and bondForRebalance. Th...

Lost fees due to precision loss in fees calculation

Handle kenzo Vulnerability details In fees calculation, division is being used in the midst of the calculation, not at the end of it. This leads to lost precision in fee amount as solidity doesn't save remainder of division. Division should happen at the end to maintain precision. Impact Lost fee...

Consider fees while calculating tvl of univ3

Handle 0x421f Vulnerability details As of now fees owed are not being considered I think here due to this A comes in deposits at time X his deposit genrates fess Now though B comes later, he gets unfair adv from As deposit Just use pool.burn to update fees I think --- The text was updated...

Users can avoid paying vault fees

Handle cmichel Vulnerability details The LPIssuer.deposit/withdraw function charges protocol&management&performance fees through inflating the LP supply in the chargeFees function. However, this LP fees minting is skipped if the elapsed time is less than the managementFeeChargeDelay: if elapsed...

UniV3Vault.sol#collectEarnings() can be front run

Handle WatchPug Vulnerability details For UniV3Vault, it seems that lp fees are collected through collectEarnings callable by the strategy and reinvested rebalanced. However, in the current implementation, unharvested yields are not included in tvl, making it vulnerable to front-run attacks that...

Extra fees paid for flash loans are unassigned

Handle 0x0x0x Vulnerability details Extra fees paid for flash loan are not included in total collected fees and they create excess balance which can be claimable by streamCreator. Extra fees should also get assigned to factory or atleast it should be clear that extra fees are for streamCreator...

Online Merchants: Prevent Fraudsters from Becoming Holiday Grinches

As the holiday shopping season gets into full swing, merchants aren’t the only ones expecting to have a prosperous year. Fraudsters, too, are out to grab their illicit share of the money changing hands or accounts in the weeks ahead. Especially susceptible to theft by fraud are millions of...

Fees can be more than 100%

Handle cmichel Vulnerability details The Overlayv1Mothership.adjustGlobalParams function allows setting a fee and feeBurn that is greater than 100%. Recommended Mitigation Steps Validate that fee and feeBurn is less than ONE = 1e18. --- The text was updated successfully, but these errors were...

Tokens with fee on transfer are not supported

Handle WatchPug Vulnerability details There are ERC20 tokens that charge fee for every transfer or transferFrom, E.g Vader token. In the current implementation, BasePoolV2.solmint assumes that the received amount is the same as the transfer amount, and uses it to calculate liquidity units. functi...

FeePoolV0.sol#distributeMochi() will unexpectedly flush treasuryShare, causing the protocol fee cannot be properly accounted for and collected

Handle WatchPug Vulnerability details distributeMochi will call buyMochi to convert mochiShare to Mochi token and call shareMochi to send Mochi to vMochi Vault and veCRV Holders. It wont touch the treasuryShare. However, in the current implementation, treasuryShare will be reset to 0. This is...

ReferralFeePoolV0.sol#claimRewardAsMochi() Array out of bound exception

Handle WatchPug Vulnerability details function claimRewardAsMochi external IUSDM usdm = engine.usdm; address memory path = new address; path0 = addressusdm; path1 = uniswapRouter.WETH; path2 = addressengine.mochi; usdm.approveaddressuniswapRouter, rewardmsg.sender; // we are going to ingore the...