The onlyMinter modifier checks the wrong condition.

Lines of code Vulnerability details Impact In RabbitHoleReceipt.sol and RabbitHoleTicket.sol, receipts and tickets can be minted by anyone. Proof of Concept The first line inside the modifier can be passed without reverting for any callers. modifier onlyMinter msg.sender == minterAddress; ; Tools...

Replayable signature in the mintReceipt function

Lines of code Vulnerability details Description In the mintReceipt function there is a check of the claimSignerAddress signature: if keccak256abi.encodePackedmsg.sender, questId != hash revert InvalidHash; if recoverSignerhash, signature != claimSignerAddress revert AddressNotSigned; The signatur...

Bad modifier definition

Lines of code Vulnerability details Impact The modifiers holding the name "onlyMinter", defined in the "contracts/RabbitHoleReceipt.sol" and "contracts/RabbitHoleTickets.sol" files do not implement an if or require checks. The lack of checking means that the modifiers do nothing about regulating...

ONLYMINTER MODIFIER WILL NOT REVERT WHEN MSG.SENDER IS NOT MINTERADDRESS

Lines of code Vulnerability details Impact onlyMinter in RabbitHoleReceipt.sol and RabbitHoleTickets.sol is noted to be housing only msg.sender == minterAddress in its code logic. RabbitHoleReceipt.solL58-L61 RabbitHoleTickets.solL47-L50 modifier onlyMinter msg.sender == minterAddress; ; It will...

Mitigation of M-04: See comments

Lines of code Vulnerability details The PR does NOT fix the issue described in the finding, and instead addresses issue 45. The change breaks out of the loop, which solves the case where the price is the same as the lowest bid, but doesn't address the case where the price is higher than the lowes...

Mitigation of M-06: Issue not mitigated

Lines of code Vulnerability details The sponsor disputes the issue, but never follows up after judge's comments, so the same issue remains in the new code. --- The text was updated successfully, but these errors were encountered: All reactions...

driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people.

Lines of code Vulnerability details Impact driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people. Proof of Concept In contract dripsHub their is no mechanism to check a user already registered under driverID or no...

Incorrect calculation

Lines of code Vulnerability details Impact On line 119, the result of the conversion is always going to be zero. Therefore, functions that apply onlyDriver modifier will never be executed. Proof of Concept Please deploy the code below to test the modifier's broken implementation. //...

Mitigation of M-05: Issue not mitigated

Lines of code Vulnerability details Mitigation of M-05: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-08: See comments

Lines of code Vulnerability details The PR applies the recommended mitigation from the finding, but the original finding's mitigation suggestion seems to indicated that the If two users place bids at the same price but with different quantities, the queue will pull from the bid with a higher...

Mitigation of M-07: Issue not mitigated

Lines of code Vulnerability details Mitigation of M-07: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-05: Issue not mitigated

Lines of code Vulnerability details The sponsor disputes the issue, but never follows up after judge's comments, so the same issue remains in the new code. --- The text was updated successfully, but these errors were encountered: All reactions...

Unpacking the "0x1626ba7e" Mystery: The Risks of Unidentified Fixed Values in Smart Contracts - loss of funds

Lines of code Vulnerability details Impact The use of a fixed value in the require statement without understanding its significance creates a security vulnerability in the contract. An attacker could manipulate the returned value to bypass the require statement and execute malicious code. This ca...

Integer Overflow Vulnerability in _addSplittable Function.

Lines of code Vulnerability details Impact splitsStorage.splitsStatesuserId.balancesassetId.splittable += amt; This vulnerability, if exploited, would allow an attacker to add a large amount of funds to a user's splittable balance, causing it to exceed the maximum value that the uint128 type can...

User might not be able to claim refund when the NFT is bought for less than the minimum reserve price

Lines of code Vulnerability details Impact User might not be able to claim refund when the NFT is bought for less than the minimum reserve price because the minReservePrices is rounded down, which make the contract refund sightly more eth to each user. In most case, the last user will not be able...

Mitigation of H-02: See comments

Lines of code Vulnerability details The PR applies the recommended mitigation from the finding, but doesn't take into account the rounding issue identified in M-09 Impact If the price the NFT is bought for is not an exact multiple of the filledQuantities, there will be a loss of precision, and...

Mitigation of M-06: Issue not mitigated

Lines of code Vulnerability details Mitigation of M-06: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

Incorrect calculation

Lines of code Vulnerability details Impact On line 119, the result of the conversion is always going to be zero. Therefore, functions that apply onlyDriver modifier will never be executed. Proof of Concept Please deploy the code below to test the modifier's broken implementation. //...

Enormous tokens can be minted by malicious user via reentrancy

Lines of code Vulnerability details Impact The function safeMInt that is used to mint new tokens, makes an external call to ERC721.sol's safeMint which contains a callback to the "to" address argument. checkOnERC721Receivedaddress0, to, tokenId, data safeMint lacks a reentrancy guard, a malicious...

Attacker can DOS OptimisticListing with very low cost

Lines of code Vulnerability details The issue that is described in code-423n4/2022-12-tessera-findings25 was not mitigated and still applies like it is described there. --- The text was updated successfully, but these errors were encountered: All reactions...