Possible to stop trading

Lines of code Vulnerability details Impact It's possible to stop market due to division by 0 exception. So better to prevent this, because better to revert with missing minAmountOut than revert with some error, which might be complicated to detect. Proof of Concept There is a change to withdraw a...

Well.sol#removeLiquidityImbalanced - Handling Excess Reserves in removeLiquidityImbalanced Function to Prevent Unnecessary Reverts

Lines of code Vulnerability details Impact The removeLiquidityImbalanced function in the Well.sol contract is vulnerable to a potential underflow. This could disrupt the contract's functionality and prevent users from removing liquidity in an imbalanced manner. Furthermore, the function does not...

LSP8CompatibleERC721._checkOnERC721Received return value is incorrect

Lines of code Vulnerability details Impact Can be transferred to EOA through safeTransferFrom Proof of Concept problematic code call path safeTransferFrom-safeTransfer-checkOnERC721Received safeTransferFrom annotate / @inheritdoc ILSP8CompatibleERC721 @dev Compatible with ERC721 safeTransferFrom...

NO ACCESS CONTROL IN THE Well.skim() EXTERNAL FUNCTION

Lines of code Vulnerability details Impact The Well.skim external function is used to transfer the excess tokens held by the Well to recipient. But there is no access control in this function and hence anyone can call this function. Therefore this function allows any arbitory user recieve the...

pump reserves will be corrupted if numberOfReserves become less

Lines of code Vulnerability details Impact Pump's reserves will be corrupted. Proof of Concept In MultiFlowPump, we didn't enforce if numberOfReserves has changed from slot.readNumberOfReserves. If update is called with less numberOfReserves, the reserves array can be corrupt, leading to unexpect...

Subsequent liquidity providers will suffer from the loss of funds

Lines of code Vulnerability details Impact When adding liquidity, lpAmountOut is calculated using the formula: calcLpTokenSupplywellFunction, reserves - totalSupply. function calcLpTokenSupply Call memory wellFunction, uint256 memory reserves internal view returns uint256 lpTokenSupply...

TWAP can be easily manipulated by attacker through the sync() function, causing loss of funds

Lines of code Vulnerability details Description Please refer to the issue titled Implementation of Well shift function allows attackers to completely manipulate the oracles for relevant introduction and context. The safety of the TWAP relies on calling the observation function update with the...

No fee swap is possible through addLiquidity and removeLiquidityImbalanced

Lines of code Vulnerability details impact Some will not pay swap fees even after the swap fee is added. proof of concept This is equivalent to swap 1000 tokenA to 500 tokenB, but no fee calculation code lies in adding and removing liquidity. Add this test in Well.AddLiquidity.t.sol. function...

The MultiFlowPump.sol/update() function will neither update nor revert any call made to it by any Well Implementation, hence will fail in storing the correct reserve values.

Lines of code Vulnerability details Impact The MultiFlowPump will not be able to update the lastReserves, emaReserves, cumulativeReserves. This will let any attacker to manipulate the value of reserves to any number. Proof of Concept As provided the code of update function, the getDeltaTimestamp...

Function collision between extension functions and account functions

Lines of code Vulnerability details Impact Users or owner can't use extensions because of collision between extension functions and account functions Proof of Concept Whenever someone calls account it will check for functions inside it, if there isn't function it goes to fallback to check...

Well.sol contract allows anyone to add liquidity to tokens with fee-on-transfer by calling the addLiquidity function

Lines of code Vulnerability details Impact A malicious user can call the wrong function for adding liquidity for a pair with fee-on-transfer tokens. The reserves information maintained within the contract suffers from an inconsistency which can result in various miscalculations for liquidity...

Due to bit-shifting errors, reserve amounts in the pump will be corrupted, resulting in wrong oracle values

Lines of code Vulnerability details Description It is advised to first read finding: Due to slot confusion, reserve amounts in the pump will be corrupted, resulting in wrong oracle values, which provides all the contextual information for this separate bug. We've discussed how a wrong sload sourc...

First liquidity provider can break minting of shares

Lines of code Vulnerability details Impact The attack vector and impact is that users may not receive shares in exchange for their deposits if the total asset amount has been manipulated through a large “donation”. Proof of Concept The attack vector and impact is that users may not receive shares...

Well.shift could suffer from front-running attack

Lines of code Vulnerability details Impact The usage of Well.shift is described in the comment: 2. Using a router with shift: WETH.transfersender=0xUSER, recipient=Well1 1 Call the router, which performs: Well1.shifttokenOut=DAI, recipient=Well2 DAI.transfersender=Well1, recipient=Well2 2...

cumulativeReserves can be incorrect

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Well updates the pump each time someone interacts with the well. update calculates the mev resistant values, one of which is the cumulativeReserves. If the update function is called twice or more times ...

Well.sol::addLiquidity() Unauthorized Liquidity Addition for Fee-on-Transfer Tokens

Lines of code Vulnerability details Description The addLiquidity in the Well.sol contract allows any address to add liquidity to tokens with a fee-on-transfer mechanism. Although there is a another function available to add liquidity for Fee-on-transfer token name addLiquidityFeeOnTransfer. Howev...

Flash loan price manipulation in Well.sol

Lines of code Vulnerability details Impact Line 214 of Well.sol calculates the price of tokens to tokens in the pool based on the balances at a single point in time. Pool balances at a single point in time can be manipulated with flash loans, which can skew the numbers to the extreme. The single...

_addLiquidity() function will revert in first call

Lines of code Vulnerability details Impact The first user cant calls the addLiquidity function because this function doesn't handle the first call. addLiquidity function is calculate lp amount by calling calcLPTokenUnderlying function. so this function has a division for lpTokenSupply. in this...

the swapFrom() function allows the Fee On Transfer tokens and _setReserves doesn't revert

Lines of code Vulnerability details Impact the protocol supports the fee on transfer tokens and has implemented a special capable function for it and wants to not allow and revert the fee on transfer tokens in normal SwapFrom function as it says in comments of swapfrom function @dev MUST revert i...

Absence of Function calcReserve(...) at src/interfaces/IBeanstalkWellFunction.sol

Lines of code Vulnerability details Impact Absence of Function calcReserve... at src/interfaces/IBeanstalkWellFunction.sol will affect the implementation of the function, the implementation is done in src/functions/ConstantProduct2.sol but the implementation cannot be accessed at...