withdrawReserve will revert when withdrawing tokens with on chain tx fees

Lines of code Vulnerability details Impact Function will revert when reserve is equal to amount, when the token being transferred is a fee on transfer token. Proof of Concept function withdrawReserve address to, uint104 amount external onlyDrawManager function withdrawReserve address to, uint104...

The MultiFlowPump.sol/update() function will neither update nor revert any call made to it by any Well Implementation, hence will fail in storing the correct reserve values.

Lines of code Vulnerability details Impact The MultiFlowPump will not be able to update the lastReserves, emaReserves, cumulativeReserves. This will let any attacker to manipulate the value of reserves to any number. Proof of Concept As provided the code of update function, the getDeltaTimestamp...

Due to slot confusion, reserve amounts in the pump will be corrupted, resulting in wrong oracle values

Lines of code Vulnerability details Description The MultiFlowPump contract stores reserve counts on every update, using the libraries LibBytes16 and LibLastReserveBytes. Those libs pack bytes16 values efficiently with the storeBytes16 and storeLastReserves functions. In case of an odd number of...

Anyone can receive funds from the Well.sol contract, thus reducing the token/tokenLp ratio for users

Lines of code Vulnerability details Impact In Well.sol skim, anyone can withdraw funds that are not in reserve by simply calling the function. Such funds may remain, for example, when transactions are rounded off. To credit extra tokens, reservetoken has sync. However, you can programmatically...

There is a large precision error in sqrt calculation of lp

Lines of code Vulnerability details Impact Compared with div, there is a larger precision error in calculating lp through sqrt, so there should be a way to check whether there are excess tokens left when adding liquidity. Proof of Concept function testCalcLpTokenSupplyDiff public uint256 memory...

Functions don't update after being called

Lines of code Vulnerability details Impact Without updating the reserve or vault value of tokens after calling different functions, the contract may be prone to inconsistent state, security issues, financial implications, and bad user experience. It is important to review and update the reserve...

AssetRegistry.swapRegistered can be called with low gas to make basket be disabled

Lines of code Vulnerability details Impact Attacker can disable basket, when swapping or unregistering not basket asset. Proof of Concept AssetRegistry.swapRegistered and AssetRegistry.unregister are both functions that can be called by governance only. It's possible that after proposal is passed...

USDC blacklisted accounts can DOS the bidding system in Shortfall

Lines of code Vulnerability details Impact Shortfall contract is used to clear off any pool bad debt via auction. If the debt reached its mimimum value, anybody can start off the auction and place the bid. Attacker can bid with tokene.g. USDC, USDT that have a contract level admin controlled...

reserve-biologique.com Cross Site Scripting vulnerability OBB-3322939

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kernel: regmap: spi: Reserve space for register address/padding

In the Linux kernel, the following vulnerability has been resolved: regmap: spi: Reserve space for register address/padding Currently the maxrawread and maxrawwrite limits in regmapspi struct do not take into account the additional size of the transmitted register address and padding. This may...

kernel: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages

In the Linux kernel, the following vulnerability has been resolved: mm,hugetlb: take hugetlblock before decrementing h-resvhugepages The h-hugepages counters are protected by the hugetlblock, but allochugepage has a corner case where it can decrement the counter outside of the lock. This could le...

There is no way to withdraw the Fees from the reserve contract

Lines of code Vulnerability details Impact This will mean 1000 of dollars worth of ZCHF in fees cannot be withdrawn by the owner Proof of Concept The reserve contract currentlyor can be the frankencoin contract also lacks a function for withdrawing ZCHF tokens, which are deposited as fees when...

Attacker can extract unlimited ZCHF by setting a high price for a position and challenging it

Lines of code Vulnerability details An attacker can act as both minter and challenger, and profit by setting an arbitrarily high price for a position way higher than what the collateral really is worth, and then immediately challenging the position. After the challenge succeeds, the attacker will...

POSITION LIMIT COULD BE FULLY REDUCED TO ZERO BY CLONES

Lines of code Vulnerability details Impact A newly opened position could have its limit fully reduced to zero as soon as the cooldown period has elapsed. Proof of Concept As seen in the function below, a newly opened position with 0 Frankencoin minted could have its limit turn 0 if the function...

Tokens with Fee on Transfer can break the PrivatePool invariant

Lines of code Vulnerability details Impact Some tokens take a transfer fee e.g. STA, PAXG, some do not currently charge a fee but may do so in the future e.g. USDT, USDC. Fees lead to the fact that the pool actually receives less funds than expected in the contract, and the reserve configuration ...

CVE-2023-25283

A stack overflow vulnerability in D-Link DIR820LA1FW106B02 allows attackers to cause a denial of service via the reserveDHCPHostName1.1.1.0 parameter to lan.asp...

D-Link DIR820LA1 缓冲区错误漏洞

D-Link DIR820LA1 is a router from China-based AUO D-Link. A security vulnerability exists in version D-Link DIR820LA1FW106B02. An attacker can exploit this vulnerability to cause a denial of service via the reserveDHCPHostName1.1.1.0 parameter in lan.asp...

Incorrect Price-Feed Failsafe System

Lines of code https://github...

Inexistent Slippage Evaluation

Lines of code Vulnerability details Impact The ecosystem of Ethos Reserve contains an EIP-4626 implementation of a vault meant to be integrated by its LUSD lending and borrowing system. As per the standard's Security Considerations itself, slippage checks need to be introduced at the integration...

ReaperVaultERC4626.sol is not EIP-4626 compliant

Lines of code Vulnerability details Impact Other protocols integrated with Ethos Reserve may mistakenly assume that its function complies with EIP-4626. Therefore, this may lead to integration issues in the future, which could result in various problems for both parties. Proof of Concept All...