Liquidatin function does not consider cases where the liquidate user does not have enough collateral to pay.

Lines of code Vulnerability details Impact Liquidatin function does not consider cases where the liquidate user does not have enough collateral to pay. Proof of Concept The problem is the paid collateral in determined by repaiddebt: I ingnored decimals for simplifcation of the formulas I'm gonna...

Pledge creator can extend pledge without paying in edge cases.

Lines of code Vulnerability details Impact Pledge creator can extend pledge without paying in edge cases. Proof of Concept When pledge creators wants to extend their pledges, they must transfer an additional reward amount and fee: uint256 totalRewardAmount = pledgeParams.rewardPerVote...

Voting Power double count when the pledge.receiver delegates to their own pledge.

Lines of code Vulnerability details Impact When a pledge is created via the createPledge function, the pledge creator is allowed to select the receiver address which will receive the boost delegation. Additionally, targetVotes parametr is selected which is the maximum target of votes the receiver...

Pod can (likely) be chosen by miner

Lines of code Vulnerability details Impact The miner can chose pod with high probability. Proof of Concept The random number generation can be easily influenced by the miner by setting block.timestamp to within an acceptable value ranging some 10-15 consecutive values seconds. Since this is hashe...

HIGH: Honest operator can lose their bonded amount although gas price was unacceptable during their slot

Lines of code Vulnerability details Description Operators in Holograph do their job by calling executeJob with the bridged in bytes from source chain. If the primary job operator did not execute the job during his allocated block slot, he is punished by taking a single bond amount and transfer it...

MED - Royalty system couples receiving address and collection request address, which may cause marketplaces to not be able to collect.

Lines of code Vulnerability details Description Royalties are managed in PA1D.sol. Owner configures several addresses which will get percentages of tokens owned by the contract. However, to receive the payout caller must be one of the eligible addresses, or the owner. This is an issue because the...

Minting and redeeming will break for fully minted tiers with reserveRate != 0 and reserveRate/MaxReserveRate tokens burned

Lines of code Vulnerability details Impact Minting and redeeming become impossible Proof of Concept uint256 numberOfNonReservesMinted = storedTier.initialQuantity - storedTier.remainingQuantity - reserveTokensMinted; uint256 numerator = uint256numberOfNonReservesMinted storedTier.reservedRate;...

JB721Delegate#initialize _fundingCycleStore lack of zero address check can lead to redeployment

Lines of code Vulnerability details Impact initialize function does not check that fundingCycleStore is not zero. Given that state variable fundingCycleStore can not be set anywhere else, setting it to zero can lead to contract redeployment POC The deployer mistakenly call JB721Delegateinitialize...

Wrong calculation in LBRouter._getAmountsIn.

Lines of code Vulnerability details Impact It calculates the amountsIn wrongly here and the function returns the wrong result. Proof of Concept Currently, getAmountsIn calculates the amountsIn like below. amountsIni - 1 = reserveIn amountOut 1000 / reserveOut - amountOut 997 + 1; As we can see...

No access control for function deployDeletateFor

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. There is no access control for the deployDelegateFor function, so anyone can call this function and initialize all the parameters for a project. Moreover, the caller can also transfer the owner to a...

Reserved token rounding can be abused to honeypot and steal user's funds

Lines of code Vulnerability details Description When the project wishes to mint reserved tokens, they call mintReservesFor which allows minting up to the amount calculated by DelegateStore's numberOfReservedTokensOutstandingFor. The function has this line: // No token minted yet? Round up to 1. i...

# Potential unbounded loops in JBTiered721DelegateStore

Lines of code Vulnerability details Impact Multiple loops in JBTiered721DelegateStore are iterating over maxTierIdOf for a nft address. This value is incremented when calling recordAddTiers. The contract doesn't seem to have a functionality for decreasing this value. Proof of Concept Over time...

Redemption weight of tiered NFTs miscalculates, making users redeem incorrect amounts - Bug #1

Lines of code Vulnerability details Description Redemption weight is a concept used in Juicebox to determine investor's eligible percentage of the non-locked funds. In redeemParams, JB721Delegate calculates user's share using: uint256 redemptionWeight = redemptionWeightOfdecodedTokenIds; uint256...

Removing tiers that weren't added

Lines of code Vulnerability details Vulnerability details Description Function recordRemoveTierIds in the JBTiered721DelegateStore removes the tiers by their ids. Perhaps, there is no check that tier is already added. Please note, the only one require that this function performs: if...

JBTiered721DelegateStore#totalRedemtionWeight contains critical tierID mismatch

Lines of code Vulnerability details Impact Loss of redemption functionality or incorrect redemptions Proof of Concept for uint256 i; i maxTierId; // Keep a reference to the stored tier. storedTier = storedTierOfnfti + 1; // Add the tier's contribution floor multiplied by the quantity minted. weig...

Missing input validation can lead to accidental burning of tokens

Lines of code Vulnerability details Impact Some token transfers do not check that the receiving address is not the zero address. This can lead to an unintended burning of tokens. Proof of Concept 1. Assume Alice uses a web3 frontend to interact with a DAI/USDT pool. 2. Alice wants to swap DAI for...

LBToken._transfer() won't work properly when _from == _to.

Lines of code Vulnerability details Impact LBToken.transfer won't work properly when from == to. Users can double their balances as they want by transferring the tokens to their accounts again. As a result, the token will be useless. Proof of Concept Inside the transfer, it uses fromBalance and...

TokenHelper.sol#L40 : safeTransfer will revert due to insufficient gas.

Lines of code Vulnerability details Impact I am adding as high issue since most of the calling is done using the safeTransfer TokenHelper.solL40 : safeTransfer will revert due to insufficient gas. All the fuctions that are using the safeTransfer could fail due to insufficient gas. I see the...

Token balance duplication if from==to

Lines of code Vulnerability details Impact In LBToken.transfer balances of from and to are stored in temporary variables and after the subtration, addition operation the results are written to storage. In the second operation since the original balance is used in the addition operation, if from =...

Internal function declared but not called

Lines of code Vulnerability details Impact JBTiered721Delegate.processPayment is an internal function that overrides JB721Delegate.processPayment, however is not called by any other function or contract. With this, users who make a paid contribution will not mint any tier for beneficiary. Proof o...