1659 matches found
Upgraded Q -> H from 104 [1656255316696]
Judge has assessed an item in Issue 104 as High risk. The relevant finding follows: L02: Incompatibility with ERC-4626 Line References Description The EIP-4626 specification requires that totalAssets to NOT revert, but the current implementation does so in the underlying methods: int256...
Yieldy._storeRebase() saves and emits wrong values.
Lines of code Vulnerability details Impact Yieldy.storeRebase saves and emits wrong values. I don't think the asset will be lost directly because of this but the rebase storage will have wrong values and it might affect the system later. Proof of Concept The previousCirculating must be a previous...
Upgraded Q -> M from 104 [1656258768065]
Judge has assessed an item in Issue 104 as Medium risk. The relevant finding follows: L01: Silent overflow of fCashAmount Line References Description If a fCashAmount value that is greater than uint88 is passed into the mint function, downcasting it to uint88 will silently overflow. Recommended...
DoS attack on claiming rewards can lead to user never being able to claim
Lines of code Vulnerability details Proof of Concept: the stake function can be called for a different recipient than msg.sender. Each time you stake tokens your warmUpInfo.expiry or the time when you are able to claim rewards grows by warmUpPeriod as is visible the last line here not the line wi...
Cannot mint to exactly max supply using _mint function
Lines of code Vulnerability details Impact Cannot mint to exactly max supply using mint function Proof of Concept requiretotalSupply MAXSUPPLY, "Max supply"; if totalSupply == MAXSUPPLY this assert will be failed and reverted. But is shouldn't be reverted as totalSupply == MAXSUPPLY is valid. Too...
No support for fee on transfer tokens
Lines of code Vulnerability details Impact stake will revert for tokens that charge a fee on transfer. Proof of Concept Note: POC below assumes tokePoolContract.depositamount transfers part of Staking.sol balance to tokePoolContract. stake uses the amount as a reference for depositToTokemak and...
[M-01] Cannot set or change curve pool after initialization
Lines of code Vulnerability details Impact Inability to set or change curve pool after initialization will hurt the project liquidity and block the ability to instant unstake from curve. Approving the CURVEPOOL address is done only on initialize and only if non zero address supplied. When using...
No check for set with address(0)
Lines of code Vulnerability details Impact can mint and get approve from address 0. Proof of Concept function setMarketPlaceaddress m external authorizedadmin returns bool if marketPlace != address0 revert ExistsmarketPlace; marketPlace = m; return true; Tools Used None Recommended Mitigation Ste...
[H-05] Not minting iPTs for lenders in several lend functions
Lines of code Vulnerability details Impact Using any of the lend function mentioned, will result in loss of funds to the lender - as the funds are transferred from them but no iPTs are sent back to them! Basically making lending via these external PTs unusable. Proof of Concept There is no mintin...
Griefing Attack by staking for any receipent
Lines of code Vulnerability details Impact Any user can grief attack and lock funds of victim by staking with victim address as recipient. Proof of Concept If warmup period is more than 1, it is possible to do this by staking with victim address as recipient with 1 wei amount, and increasing the...
Staking: Attacker can stake very few tokens for others to increase the lock time of others' tokens.
Lines of code Vulnerability details Impact In the stake function of the Staking contract, anyone can stake tokens for others. And each time a token is staked, the lock time of all tokens is increased. This allows an attacker to stake few tokens for others to increase the lock time of others'...
Griefers can prevent users from claiming YIELDY_TOKENs from the warm up
Lines of code Vulnerability details Impact When warmUpPeriod is greater than 0, anyone can deny i.e.: grief any user from claiming their YIELDYTOKENs from Staking.sol. Proof of Concept 1. Admin sets the warmUpPeriod to 2. 2. A user deposits a decent amount STAKINGTOKENs, with the expectation that...
Upgraded Q -> H from 285 [1655952312863]
Judge has assessed an item in Issue 285 as High risk. The relevant finding follows: 1. Excess ether sent to FixedPricePassThruGate is lost low passThruGate redirects to a beneficiary only gate.ethCost, requiring that msg.value = gate.ethCost. As there are no other ways to access native tokens hel...
missed valid address check for assetAddress
Lines of code Vulnerability details Impact Malicious Actor can do DoS using Reentrance using createVault and can create vault without depositing any asset Proof of Concept pragma solidity ^0.8.10; import "./NibblVaultFactory.sol"; contract ERC721Attack address curator =...
Transition notBoughtOut -> boughtOut -> notBoughtOut possible because of updateTWAV
Lines of code Vulnerability details Impact Because rejectBuyout uses the TWAV, which is time-weighted and updateTWAV can be called, it is possible that notBoughtOut is true at first, then boughtOut is true, and then notBoughtOut is true again. See Proof of Concept for how one can construct such a...
WETH#approve can be used to steal user balances
Lines of code Vulnerability details Impact In WETH.sol 2nd approve function can be used to update allowance of any user, it can be used to steal users balance Proof of Concept function approveaddress owner, address spender external returnsbool approveowner, spender, balanceOfowner; return true;...
Overprivileged admin can grant unlimited WETH
Lines of code Vulnerability details Impact Admin can grantComp to any address using any amount and drain the contract. Proof of Concept If admin key gets compromised there is no timelock, no amount boundaries and no address limitations to prevent the assets to be drained immediately to the...
WETH.allowance() returns wrong result.
Lines of code Vulnerability details Impact WETH.allowance returns wrong result. I can't find other contracts that use this function but WETH.sol is a base contract and it should be fixed properly. Proof of Concept In this function, the "return" keyword is missing and it will always output 0 in th...
Transferring any amount of the underlying token to the CNote contract will make the contract functions unusable
Lines of code Vulnerability details Impact The contract expects the balance of the underlying token to == 0 at all points when calling the contract functions by requiring getCashPrior == 0, which checks token.balanceOfaddressthis where token is the underlying asset. An attacker can transfer any...