A user could call mint() with less ETH than the mintPrice and improperly mint badges for a cheaper cost.

Lines of code Vulnerability details Impact users underpaying to mint badges will lead to loss of funds Proof of Concept It checks if msg.value is less than the required mintPrice, but it does not check for the case where msg.value mintPrice. This means: A user could send only 1 wei when the...

InterchainProposalExecutor will fail if any proposal requires value transfer, breaking core logic

Lines of code Vulnerability details Impact Proposals which are sent from a source chain using InterchainProposalSender to a destination chain to be executed using InterchainProposalExecutor are intended to support function calls that include transfers of ETH, or other native token. However, the...

sendToken() shouldn't have metadata parameter

Lines of code Vulnerability details Impact Users calling sendToken with metadata may trigger a revert or lose the calldata if its size is 1-3 bytes when the destination is an EOA. Proof of Concept In transmitSendToken, we discard the calldata if it's less than 4 bytes, and revert if it's bigger o...

Addresses in modifier not set correctly

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Addresses that are mintlimiter but not governance will revert thus being able not to call some functions as intended. Proof of Concept In the comment it was stated that it is either mint limiter or...

InitProxy and Proxy may revert preventing successful init

Lines of code Vulnerability details Impact When InitProxy is constructed the owner is set to be the sender address so that the init function can only be called by the same sender address. If the init function is receiving a new owner, the implementation may revert during setup preventing proxy...

Potential Reversion in Transfer due to LSP1 Interface Support Check

Lines of code Vulnerability details Impact The transfer function in LSP7DigitalAssetCore & LSP8DigitalAssetCore includes a mandatory hook, notifyTokenSender, which verifies if the sender supports INTERFACEIDLSP1. However, if a token owner who initially implemented LSP1 interface ceases to support...

An identical vault can be deployed with existing values, the logic controlling this is missing

Lines of code Vulnerability details VaultFactory. The deployVault function deploys a new vault with 10 arguments, but does not check if there is a vault already deployed with the same arguments This seems to have been preferred as a design, but malicious people with copy safes can direct users to...

Vetoer can veto a non-existent proposal

Lines of code Vulnerability details Impact Vetoer is allowed to veto an invalid proposalId, which would prevent that proposal from getting votes, queued or executed. Proof of Concept Here is the veto function: function vetoNounsDAOStorageV3.StorageV3 storage ds, uint256 proposalId external if...

Upgraded Q -> 2 from #727 [1689056911947]

Judge has assessed an item in Issue 727 as 2 risk. The relevant finding follows: ERC20 revert due to sigs issue --- The text was updated successfully, but these errors were encountered: All reactions...

Possible to stop trading

Lines of code Vulnerability details Impact It's possible to stop market due to division by 0 exception. So better to prevent this, because better to revert with missing minAmountOut than revert with some error, which might be complicated to detect. Proof of Concept There is a change to withdraw a...

First liquidity provider can break minting of shares

Lines of code Vulnerability details Impact The attack vector and impact is that users may not receive shares in exchange for their deposits if the total asset amount has been manipulated through a large “donation”. Proof of Concept The attack vector and impact is that users may not receive shares...

CRITICAL UPGRADES IN THE DIAMOND PROXY COULD BE MISSED DUE TO INVALID ACTIONS PASSED IN

Lines of code Vulnerability details Impact The LibDiamond.diamondCut function is used to modify the facets by passing in the FacetCut structs. The FacetCut struct contains the action to perform: add, replace and remove and the function selectors to use for them. Here the function implementation...

In VirtualAccount.sol.withdrawERC20(), Transaction revert if the Token does not support 0 value transfer

Lines of code Vulnerability details Impact In VirtualAccount.sol.withdrawERC20, Transaction revert if the Token does not support 0 value transfer when transferring tokens to recipient address. File: src/ulysses-omnichain/VirtualAccount.sol 31 function withdrawERC20address token, uint256 amount...

Getting exchange rate function is wrong

Lines of code Vulnerability details Impact Unmatched function for getting the exchange rate can lead to being unable to mint PeUSD when depositing ETH into Rocket Pool. Proof of Concept The interface used in LybraRETHVault.sol for getting the exchange rate does not match the target contract RETH...

[H] Eth remains stuck in contract due to reversion in convertToPeUSD

Lines of code Vulnerability details Impact ETH sent with this call will not be refunded to the caller upon revert. Proof of Concept Due to a discrepancy in the convertToPeUSD function where the call to mintVault implemenation from transferFrom is non-existent, the subsequent call to...

Missing store revert in case of swap error can lead to loss of funds

Lines of code Vulnerability details Impact The module is expected to have no state changes in case a swap failed, and continue to the conversion phase. It was implemented by swallowing the error with a log and continuing with the flow erc20 conversion, etc. This is the relevant code section:...

getPORFeedData() doesn't validate price feed answers (totalETHBalanceInInt and totalETHXSupplyInInt) before casting to uint256

Lines of code Vulnerability details Impact If a negative value is returned 0 from chainlink oracle and the value is cast to type uint256, the resulting value will be the unsigned representation of that value which will be an inaccurate price. Also, cases where sdprice can't be less than 0 will...

Upgraded Q -> 2 from #48 [1686129354989]

Judge has assessed an item in Issue 48 as 2 risk. The relevant finding follows: CALLING transfer FUNCTION TO SEND ETH CAN REVERT --- The text was updated successfully, but these errors were encountered: All reactions...

Borrower can block being defaulted or auctioned

Lines of code Vulnerability details Borrower can block being defaulted or auctioned The borrower can potentially block the liquidation and auction processed by using a contract and reverting on ETH transfers. Impact When a loan is being liquidated or auctioned, any credit still available to the...

ParticleExchange.auctionBuyNft and ParticleExchange.withdrawEthWithInterest function calls can be DOS'ed

Lines of code Vulnerability details Impact When lien.borrower is a contract, its receive function can be coded to conditionally revert based on a state boolean variable controlled by lien.borrower's owner. As long as payback 0 is true, lien.borrower's receive function would be called when calling...