Reentrancy issues on function distributePayoutsOf

Lines of code Vulnerability details Impact In the contract JBPayoutRedemptionPaymentTerminal, the function distributePayoutsOf calls the internal function distributePayoutsOf and this internal function perfoms a loop where is using the function distributeToPayoutSplitsOfhttps://githu...

CreateFor#JBProjects.sol is vulnerable to reentrancy

Lines of code Vulnerability details Impact Reentrancy attack can trick users by spamming incorrect project Id event emission Proof of Concept The function createFor which uses safeMint is lacking any form a reentrancy protection. OZ Safe Mint implementation is function safeMint address to, uint25...

Attacker can frontrun and reenter this function causing users to get griefed

Lines of code Vulnerability details Impact 1. attacker calls createFor and there is reentracy in safemint and an attacker can reenter and just keep increasing count just a side note 2. but what an attacker can do is when a user wants to call this function or launch a project an attacker frontruns...

JBProjects.sol#createFor(...) function is open to reentrancy attacks

Lines of code Vulnerability details JBProjects.solcreateFor... which used in JPController.sollaunchProjectFor... can be used for reentrancy. PoC contracts/JBProjects.sol: 131: function createForaddress owner, JBProjectMetadata calldatametadata 132 external 133 override 134 returns uint256 project...

Reentrancy vulnerability due to _distributePayoutsOf

Lines of code Vulnerability details The function distributePayoutsOf has reentrancy vulnerability which is being called by the external function distributePayoutsOf There are external calls in this function along with calls sending ETH Impact The contract JBPayoutRedemptionPaymentTerminal inherit...

Reentrancy vulnerabilities

Lines of code Vulnerability details Impact Reentrancy attacks can allow malicious actors to take over the control flow, and make...

Lack of lock modifier on sell() can lead to reentrancy

Lines of code Vulnerability details Impact NibblVault.sell does not possess the lock modifier that protects against reentrancy. The only attack vector due to reentrancy in this function was found to be executable by the factory that receives the admin fees which is not plausible due to the curren...

Reentrancy bug in Basket's withdraw multiple tokens function which gives attacker ability to transfer basket ownership and spend it but withdraw all the tokens out of basket

Lines of code Vulnerability details Impact Basket is used for keep multiple tokens in contract and mint one NFT token to represent their ownership. Basket only allows for owner of NFTid=0 to withdraw tokens from Basket address. users can deposit multiple tokens in one Basket and then create a...

[PNM-005] Reentrancy of function sell

Lines of code Vulnerability details Description In function chargeFee, a potential reetrancy can be triggered by the factory. Since function sell invokes chargeFee in the middle of its function body, it potentially impacts the calculation, e.g., the totalSupply would be incorrect since the tokens...

REENTRANCY-Avoid transfer() as reentrancy mitigations. Transfer do not protect from reentrancies in case of gas price changes.

Lines of code Vulnerability details Impact --Check: reentrancy-unlimited-gas --Severity: Informational --Confidence: Medium Transfer and send have been recommended as a security best-practice to prevent reentrancy attacks because they only forward 2300 gas. That being said, gas repricing of...

initiateBuyout and sell functions on NibbleVault.sol Reentrancy vulnerability

Lines of code Vulnerability details Impact 1. In NibbleVault.sol, it is possible for a contract to prevent the Sell event from being fired after being sent ether. From calling the sell function on line 390, an attacker contract is able to keep the event hidden from being listened to by stopping t...

MasterChef's emergencyWithdraw can be reentered drawing all lptokens from the contract if pool.lpToken allows for transfer flow control

Lines of code Vulnerability details User's LP funds accounting update in emergencyWithdraw happens after lpToken transfer. If pool.lpToken allows for the control of transfer call flow or can be upgraded to allow it in the future i.e. beforetokentransfer, afterTokenTransfer type of hooks, or an...

CNote updates the accounts after sending the funds, allowing for reentrancy

Lines of code Vulnerability details Having no reentrancy control and updating the records after external interactions allows for funds draining by reentrancy. Setting the severity to medium as this is conditional to transfer flow control introduction on future upgrades, but the impact is up to th...

Upgraded Q -> M from 135 [1655579793739]

Judge has assessed an item in Issue 135 as Medium risk. The relevant finding follows: L send is not recommended for sending native token Since the introduction of transfer, it has typically been recommended by the security community because it helps guard against reentrancy attacks. This guidance...

Upgraded Q -> M from 143 [1655579880057]

Judge has assessed an item in Issue 143 as Medium risk. The relevant finding follows: L-04 safeTransferETH should perform simple ETH transfers and don’t forward 30k gas Link: Being a simple funds transfer, having a fallback of a WETH deposit, there should be no extra gas involved when potentially...

Update initializer modifier to prevent reentrancy during initialization

Lines of code Vulnerability details Impact The solution uses: "OpenZeppelin/[email protected]". This dependency has a known high severity vulnerability: Which makes MyStrategy contract vulnerable contract MyStrategy is BaseStrategy, ReentrancyGuardUpgradeable ... function...

Upgraded Q -> M from 270 [1655579826704]

Judge has assessed an item in Issue 270 as Medium risk. The relevant finding follows: Gas stipend for payable.send may be too low for contract wallets ETH withdrawals in both the minter and token contracts use payableaddress.send to transfer ether to the vault address. If the configured vault is ...

Missing reentrancy protections

Lines of code Vulnerability details Impact The files below contain both deposit and withdraw functions which seem re-entrable at the point of calls that transfer tokens. The functions do not fully follow a checks-effects-interactions pattern, thus they can be re-entered multiple times. Depending ...

reentrancy by _harvest() and _deposit() code in the middle of claimBribesFromHiddenHand() external calls to tokens and change balances of AURA token so claimBribesFromHiddenHand() make wrong transfers and fund would be lost

Lines of code Vulnerability details Impact Function claimBribesFromHiddenHand makes some external calls to token lists which fetches from hiddenHandDistributor.rewards if AURA was on of those tokens and also one of those tokens were malicious or made some external call then it's possible to reent...

Update initializer modifier to prevent reentrancy during initialization

Lines of code Vulnerability details The solution uses: OpenZeppelin/[email protected] These dependencies have a known high severity vulnerability: Which makes these contracts vulnerable: Recommended Mitigation Steps Upgrade @openzeppelin/contracts-upgradeable to version 4.4...