Users are unable to revoke consents

Lines of code Vulnerability details Impact Neither lenders nor borrowers can revoke mutualConsents. This can pose an issue if a lender has given consent to lend funds but a borrower has proven untrustworthy either through actions in another credit line or some other public way. A lender should be...

Reentrancy in _close() allows single lender to steal all deposits from other lenders

Lines of code Vulnerability details Impact Upon calling close, a lender's credit position is deleted AFTER the transfer out of their deposit. Therefore, an ERC777 will allow the lender to call close again and receive the same amount of funds. The lender will be able to reenter the contract as man...

L2 deposits might be reverted

Lines of code Vulnerability details Impact L1ERC20Bridge and L1EthBridge contracts have claimFailedDeposit function to withdraw funds from the initiated deposit, which failed when finalizing on L2. However, if the caller is allowed in senderCanCallFunction modifier, this function can be used to...

Not possible to DiamondCut in frozen status

Lines of code Vulnerability details Impact DiamondCut's executeDiamondCutProposal executes the proposed diamondCut calldata in the Diamond is unfrozen condition. However, if there are any possible situations that require restriction implementation in which the upgrade should be executed in a froz...

Funds can be stolen

Lines of code Vulnerability details Impact For L2, any deposit finalization should come from L1 bridge address. Now the MailBox contract is currently helping to simulate such calls to be coming from L1. The problem is if within zkSync ecosystem, a contract is deployed with address same as L1 brid...

Wrong bidIndex calculation

Lines of code Vulnerability details Impact Return wrong bidIndex Proof of Concept SizeSealed.sol Tools Used Manual Recommended Mitigation Steps uint256 bidIndex = a.bids.length - 1 ; --- The text was updated successfully, but these errors were encountered: 👎 1 trust1995 reacted with thumbs down...

msg.sender token balance is not checked before calling safeTransferFrom function

Lines of code Vulnerability details Impact createAuction FUNCTION and bid FUNCTION: Without checking the msg.sender token balance the transfer function may be failed to transfer token from msg.sender to contract address . this may cause a transactions failures. Same instance in 2 times PROOF OF...

Denial of service from malicious bidder by filling up the bid index up until 1000

Lines of code Vulnerability details Impact Denial of service from malicious bidder by filling up the bid index up until 1000 Proof of Concept Initially inside bid function there is a check condition if bidIndex = 1000 then it will revert, so this will limit the size of bid created by bidder to...

A bidder can buy baseToken with low price by exploiting the DOS prevention measure

Lines of code Vulnerability details Impact In order to prevent DOS attacks, the smart contract introduces a measure that limits the number of bids on an auction SizeSealed.solL157-L159. However, an attacker/bidder can exploit this measure to block others to place bids so that the attacker can buy...

Some cases maybe cause the bids unable to get their funds back.

Lines of code Vulnerability details Impact All of the following there cases maybe cause the bids unable to get their funds back. Details case1: If sellerwho is a bad man does not reveal in the reveal period, then all the bids will be unable to get their funds back. case2: If sellerwho is a bad ma...

initializer modifier on constructor function

Lines of code Vulnerability details Impact In L2StandardERC20.sol the initializer modifier is placed both on the constructor function and on the bridgeInitialize function. When the initializer modifier is used it cannot be called again on any function in the contract since it will revert with a...

Deprecated ChainLink API

Lines of code Vulnerability details Impact According to Chainlink's documentation, the latestAnswer function is deprecated. This function might suddenly stop working if Chainlink stop supporting deprecated APIs. And the old API can return stale data. Proof of Concept function latestAnswer externa...

SimpleERC20Escrow's initialize() can be frontrun

Lines of code Vulnerability details Impact The user's collateral is not held in the market contract but is instead held in individual escrows. Every user has a unique escrow for every market. And the escrow contracts are created via the Market contract's createEscrow function. And it's initialize...

Transfer from does not make check for allowance size

Lines of code Vulnerability details Impact Transfer from does not make check for allowance size Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Add check to be sure that currentAllowance = amount is true --- The text was updated successfully, but these errors were...

Front-running approve function

Lines of code Vulnerability details Description There is approve function in a DolaBorrowingRights. Let's say that Alice wants to increase the approval for Bob from 10 to 20. Alice calls the approve or permit function. Then, Bob can front-run the transaction by spending the 10 tokens and getting...

Owner can bypass ERC20 recovery restrictions and take all rewards

Lines of code Vulnerability details Impact There is a function that is intended to be used to recover ERC20 tokens that were sent to the WardenPledge contract by accident. The function is only usable by the owner and contains a check that no tokens can be taken which are currently whitelisted as...

users can mint infinite tokens xINV

Lines of code Vulnerability details Impact i not very clearly if this work how you want but i think that not is good taht a user can mint tokens infinitos hence i mark it high risk Proof of Concept with just have 1 token in the contract uint invBalance = token.balanceOfaddressthis; allows mint...

Owner can bypass reward token protection in recoverERC20 to instantly steal all tokens in contract

Lines of code Vulnerability details Description WardenPledge contract has a sweeping function recoverERC20 to handle mistakenly sent ERC20 tokens: function recoverERC20address token external onlyOwner returnsbool ifminAmountRewardTokentoken != 0 revert Errors.CannotRecoverToken; uint256 amount =...

No access control for initialize in diamondinit

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The initialize function has no access control and thus a malicious user can call it an rest all the the parameters of the system. Proof of Concept Provide direct links to all referenced code in GitHub...

The pledge creators might lose all of their funds by recoverERC20().

Lines of code Vulnerability details Impact There is a recoverERC20 function to withdraw ERC20 tokens from the contract. Currently, it checks if the token isn't an active reward token but it can be passed easily if the admin removes the reward token using removeRewardToken. So if the admin removes...