The whole collateral can be liquidatedThe whole collateral can be liquidated

Lines of code Vulnerability details The whole collateral can be liquidated Impact According to the current mechanism, if the proportion is set to 100%, and some user's profile barely trigger the liquidation threshold, the whole collateral could be liquidated all at once. However, the user's profi...

Caller can receive liquidatorCut without transferring underlying when calling payBase()

Lines of code Vulnerability details Impact If baseJoin's available balance is greater than callers' amount no underlying will be transferred but caller still gets liquidatorCut. This may also negatively impact the accounting since its updated under the assumption that the caller will transfer...

If baseJoin's available balance is greater than callers' amount no underlying will be transferred.

Lines of code Vulnerability details Impact If callers' amount is greater than baseJoin's available balance no underlying will be transferred but caller still gets liquidatorCut. This may also negatively impact the accounting since its updated under the assumption that the caller will transfer...

Auctioneer could be left without reward

Lines of code Vulnerability details Impact Reward amount to whomever started the auction auctioneerCut counts at the moment when auction is bought, based on current auctioneerReward value using calcPayout function. ... if auction.auctioneer != to auctioneerCut = liquidatorCut.wmulauctioneerReward...

There is no method to unignore any ignored pair.

Lines of code Vulnerability details Impact The Witch contract uses setIgnoredPair function to prevent the liquidation of accepted pairs on the governance level. However, there is no method to remove these pairs from the ignoredPairs mapping. Proof of Concept Imagine there are vaults with UST/fyUS...

CHECK VALID ADDRESS for _auctionStarted

Lines of code%20internal%20virtual%20%7BL214 Vulnerability details Impact Should check for valid address before giving so it can revert if it isn't. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the...

Reduce the incentive of self liquidation

Lines of code Vulnerability details Reduce the incentive of self liquidation Impact In some situations the borrower may have incentive to self liquidate. For example: May pay less interest Redeem early and reduce the loss or the fee React to abrupt market volitility Other cases to circumvent some...

Someone can create non-liquidatable auction if the collateral asset fails on transferring to address(0)

Lines of code Vulnerability details Impact might lead to systematic debt. Cause errors for liquidators to run normally. Proof of Concept In the function auction, there is on input validation around whether the to is address0 or not. and if the auctioneerReward is set to an value 0 as default, eac...

Validation check for payFYToken and payBase functions to allow only valid users.

Lines of code Vulnerability details Impact This will prevent from calling the functions by invalid users. Unnecessary condition verification. Proof of Concept Tools Used Manual code review Recommended Mitigation Steps At the start of the functions, add validation check such that only the user who...

Collateral limit can be bypassed in auction

Lines of code Vulnerability details Collateral limit could be bypassed, allowing more collateral to be auctioned concurrently than intended by governance. // There is a limit on how much collateral can be concurrently put at auction, but it is a soft limit. // If the limit has been surpassed, no...

Liquidator cut is calculated incorrectly

Lines of code Vulnerability details Impact User can call payBase function to pay debt in return for collateral. But due to incorrect calculation User will obtain lesser collateral than what he should actually receive causing immediate permanent loss Proof of Concept 1. User calls payBase function...

Closing auction return value Of cauldron is not checked

Lines of code Vulnerability details Impact When the auction is ended, cauldron gaves vault id with related parameters. However, the return value is not checked on the cauldron. If the cauldron does not revert, the protocol can delete auction without functionality. Proof of Concept Tools Used Code...

Caller Can Receive Both liquidatorCut and auctioneerCut

Lines of code Vulnerability details Impact Caller can call auction from one address then call payBase or payFYToken from another address receiving both liquidatorCut and auctioneerCut. Proof of Concept A caller calls auction passing in an address the caller controls, Address A, into the to...

Swivel.setFee() is implemented wrongly.

Lines of code Vulnerability details Impact Swivel.setFee is implemented wrongly. Swivel.feenominators won't be set as expected. Proof of Concept This function has a parameter "i" for the index of the new fee denomination but it isn't used during the update. Tools Used Solidity Visual Developer of...

Collateral limit can be exceeded on a new auction

Lines of code Vulnerability details Witch's auction checks the total collateral limit before updating the structure with the current auction's data. This way this limit end up not being respected in result of auction call and can be actually breached for an arbitrary big amount as auction.ink tha...

Proposal commitment takes all fractional balance in Migration contract

Lines of code Vulnerability details Impact The Migration contract holds all fractional token balance of all proposals. Let's suppose a single vault has multiple proposals going on, and one gets committed. If the target price is satisfied, then a buyout starts // Checks if the current price is...

Incorrect condition will always fail withdrawal

Lines of code Vulnerability details Impact Due to an incorrect approval check, the if condition will always lead to transaction reversal when withdrawal is requested for a holder who is not msg.sender. This can lead to user unable to withdraw funds Proof of Concept 1. Let us see the withdraw...

fractionPrice precision can be lost if fractional tokens supply is high enough

Lines of code Vulnerability details Buyout's start now determine fractional token price by dividing native tokens amount by total supply number. Whenever the supply is high enough the precision can be lost, leading to severe losses to buyout proposer as his staked fractional tokens can be valued ...

TEST

Lines of code L1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- Th...

User can block migration actions by starting buyout process

Lines of code Vulnerability details Impact All migration actions such as propose, join, leave, and commit require that the pool's buyout state is INACTIVE. At any point, a user can call buyout.Start to start the buyout process which will change the buyout state to LIVE. Proof of Concept...