Reentrancy vulnerability in Singularity.execute

Lines of code Vulnerability details Impact This vulnerability could allow an attacker to withdraw funds from the Singularity contract. This could result in a loss of funds for the user. Proof of Concept The Singularity.execute function has external calls inside a loop. This could potentially lead...

Setting debtStartPoint > 0 breaks many BigBang actions

Lines of code Vulnerability details Impact If BigBang.debtStartPoint is set to a value 0, many core features will break, e.g. deposits of collateral will be possible, but removal not, which would effectively lock collateral inside the contract. Proof of Concept BigBang.getDebtRate uses the variab...

TapOFT.sol: Incorrect emission value due to division by higher decimal value

Lines of code Vulnerability details Impact Incorrect emission value which will be used in per week emission. Proof of Concept TapOFT.sol has the computeEmission function to calculate the emitted value. The output from this function is used in emitForWeek. when we look at the function...

BigBang liquidations causes YieldBox-tokens to be locked in contract

Lines of code Vulnerability details Impact When a position gets liquidated in BigBang the contract will receive YieldBox-assetId-tokens of which some are sent to the liquidator and penrose-fee-receiver. The rest will get stuck in the contract and cannot be claimed as fees in refreshPenroseFees...

RTokenAsset price estimation accounts for margin of error twice

Lines of code Vulnerability details RTokenAsset estimates the price by multiplying the BU basket unit price estimation by the estimation of baskets held then dividing by total supply. The issue is that both BU and baskets held account for price margin of error, widening the range of the price mor...

CTokenV3Collateral._underlyingRefPerTok should use the decimals from underlying Comet.

Lines of code Vulnerability details Impact CTokenV3Collateral.underlyingRefPerTok uses erc20Decimals which is the decimals of CusdcV3Wrapper. But it should use the decimals of the underlying Comet. Proof of Concept CTokenV3Collateral.underlyingRefPerTokcomputes the actual quantity of whole...

Loss of Funds when user wants to repay debt and underflow in _repay () function

Lines of code Vulnerability details Impact There is no check for if userBorrowPartto is greater than or equal to part before subtraction which can lead to loss of funds for user or underflow, incase a user inputs more amount than the user is in debt for. Proof of Concept Provide direct links to a...

rate is wrong

Lines of code Vulnerability details Impact attacker can manipulate pool price to make strategy have eth lower as it should have 1 seth 1 eth then mint new steth 1 steth = 1 eth so attacker can gain share more than normal Proof of Concept 1. attacker manipulate pool price 1 seth 1 eth 2. attacker...

Reentrancy vulnerability in BigBang.execute

Lines of code Vulnerability details Impact This vulnerability could allow an attacker to withdraw funds from the BigBang contract. This could result in a loss of funds for the user. Proof of Concept The BigBang.execute function has external calls inside a loop. This could potentially lead to...

Incorrect Interest Accrual Calculation in 'SGLCommon' Contract

Lines of code Vulnerability details Description The 'SGLCommon' contract contains a critical vulnerability in the interest accrual calculation, particularly in the computation of the 'extraAmount' used for accruing interest. The flaw arises from always dividing by 1e18, disregarding the number of...

PT-2023-27942 · WordPress · Wp Ultimate Csv Importer

Name of the Vulnerable Software and Affected Versions: WP Ultimate CSV Importer plugin for WordPress versions up to, and including, 7.9.8 Description: The issue allows authenticated attackers with author-level permissions or above to execute code on the server via the -cus1 parameter, if the...

_sendToken in tapiocaz::Balancer::rebalance() not sending native fee will lead to revert

Lines of code Vulnerability details Impact function sendToken address payable oft, uint256 amount, uint16 dstChainId, uint256 slippage, bytes memory data private IERC20Metadata erc20 = IERC20MetadataITapiocaOFToft.erc20; if erc20.balanceOfaddressthis amount revert ExceedsBalance; uint256 srcPoolI...

CBEthCollateral and AnkrStakedEthCollateral _underlyingRefPerTok is incorrect

Lines of code Vulnerability details The CBEthCollateral.underlyingRefPerTok function just uses CBEth.exchangeRate to get the ref/tok rate. The CBEth.exchangeRate can only get the conversion rate from cbETH to staked ETH2 on the coinbase. However as the docs...

Miusing empty string insteaf of oracleData in updateExchangeRate

Lines of code Vulnerability details Impact contract has this storage: /// @notice oracleData bytes public oracleData; updated, rate = oracle.get""; Instead of oracle.get"", it should use proper oracle data which was set otherwise it can lead to undefined behavior where oracle expects data. Proof ...

Insufficient Authorization Checks in 'SGLLeverage' Contract Functions

Lines of code Vulnerability details Description The 'SGLLeverage' contract contains critical vulnerabilities in multiple functions, including 'multiHopBuyCollateral,' 'multiHopSellCollateral,' 'sellCollateral,' and 'buyCollateral.' These functions lack proper authorization checks, allowing any us...

Reentrancy vulnerability in BaseUSDO._executeModule() function

Lines of code Vulnerability details Impact the success variable in the executeModule function in the BaseUSDO contract is written in both line 366 and line 369. This could potentially lead to a reentrancy vulnerability. In line 366, the success variable is set to true. In line 369, the success...

CurveStableMetapoolCollateral.tryPrice returns a huge but valid high price when the price oracle of pairedToken is timeout

Lines of code Vulnerability details The CurveStableMetapoolCollateral is intended for 2-fiattoken stable metapools. The metapoolToken coin0 is pairedToken and the coin1 is lpToken, e.g. 3CRV. And the config.chainlinkFeed should be set for paired token. Impact The CurveStableMetapoolCollateral.pri...

AirdropBroker.sol#L442 : _participatePhase3 - PHASE_3_AMOUNT_PER_USER should be multiplied by 1e18

Lines of code Vulnerability details Impact Incorrect eligibleAmount is minted to the user. Proof of Concept An eligible user can call the participatePhase3 function and mint the aToken to them. function participatePhase3 bytes calldata data internal returns uint256 oTAPTokenID uint256 tokenID =...

cbETH's fails to check for a depeg since pegPrice is always 1

Lines of code Vulnerability details Whenever refresh is called for a collateral it does a few checks, one of them is to ensure the collateral didn't depge. It does so by calling tryPrice and checking that the returned parameter pegPrice which is supposed to represent the current price of the...

Signature Validation Bypass in 'permit' Function of MarketERC20.sol

Lines of code Vulnerability details Description The 'MarketERC20.sol' contract contains a critical vulnerability in the 'permit' function, where insufficient signature validation allows for bypassing the authentication process. This loophole enables attackers to manipulate the function by providi...