_payoutToken() breaks if tokenAddress is USDT - for Ethereum contracts.

Lines of code Vulnerability details If USDT is used for a sale at some point - either through a direct sale on the NFT collection, or sent to the collection from a marketplace sale - it will remain in the contract, as getTokenPayoutaddressUSDT calls systematically revert: on Ethereum, USDT.transf...

_payoutEth() gas computation can make call revert even if balance is sufficient

Lines of code Vulnerability details Payout recipients can call getEthPayout to transfer the ETH balance of the contract to all payout recipients. This function makes an internal call to payoutEth, which computes the gasCost, then proceeds to check balance - gasCost 10000 before sending the result...

Logical error in function getSwapOut

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. There is a logical error between lines 178-184 for function getSwapOut in contract LBRouter if amountIn != 0 activeId = LBPair.findFirstNonEmptyBinIduint24activeId, swapForY; else break; // end while if...

TokenHelper.sol#L40 : safeTransfer will revert due to insufficient gas.

Lines of code Vulnerability details Impact I am adding as high issue since most of the calling is done using the safeTransfer TokenHelper.solL40 : safeTransfer will revert due to insufficient gas. All the fuctions that are using the safeTransfer could fail due to insufficient gas. I see the...

Upgraded Q -> M from 400 [1666366548697]

Judge has assessed an item in Issue 400 as Medium risk. The relevant finding follows: Use address.call instead of payable.transfer Avoid use of transfer to send ether since transfer sends a fixed amount of gas and future gas cost change may cause revert, The receiving contract will also revert if...

Initialize: No access control for initializatino and possible multiple initializations

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. First of all, there is no modifier for access control, any one can call initialize and the two require statements won't provent it. Second, it is possible that the initialize function is called multiple...

[M1] _executeTokenTransfer can succeed without transferring tokens

Lines of code Vulnerability details Impact NFT Tokens may not be transferred in execute PoC During compile time AssetType can be either ERC721 or ERC1155 0 or 1. However, in execution time this value can be more than 1. ​ ​ The internal function executeTokenTransfer will succeed when AssetType 1...

Missing zero value check in AlgebraPool.initialize() would cause reverts preventing minting and swapping.

Lines of code Vulnerability details Impact The initialize function in AlgebraPool contract sets the globalState price and tick for the Algebra Pool. However, due to a missing check to ensure the price is not set to zero, a revert would occur always when calculating amounts for liquidity in...

ArtGobblers.sol#L396-L402 : The function "gobblerPrice()" does not check whether the mint has started or not

Lines of code Vulnerability details Impact This could revert due to undeflow. Proof of Concept While calculating the gobblerPrice, the function does not check whether the mintStart time is started or not. If it is future time, calling this could revert. This could affect the mintFromGoo function ...

Overflow can make a claim impossible to revoke by the admin and fully withdraw by the recipient

Lines of code Vulnerability details Impact In contract VTVLVesting.sol, the multiplication in function baseVestedAmount can overflow for big enough values of truncatedCurrentVestingDurationSecs and linearVestAmount. This means the claim could be successfully created by the admin, but could NEVER ...

timewindow can be changed unexpectedly that blocks users from calling deposit function

Lines of code Vulnerability details Impact As shown by the following epochHasNotStarted modifier, which is used by the deposit function below, users can only deposit when block.timestamp modifier epochHa...

Locked ether

Lines of code Vulnerability details Impact In contract Party.sol there is a receive declared. This means that the contract can accept eth payments. But there is no function defined , to withdraw those sent ether. So if a user accidently sent ether to the contract, the ether would be locked, as...

GSD-2022-1005424 fbdev: fbcon: Properly revert changes when vc_resize() failed

fbdev: fbcon: Properly revert changes when vcresize failed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.64 by commit...

GSD-2022-1005336 arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"

arm64: kasan: Revert "arm64: mte: reset the page tag in page-flags" This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...

Contracts that lock Ether

Lines of code Vulnerability details Impact When receive function, hasn't a revert all ethers send contracts will be locked forever. Proof of Concept Bob send ether to contract, funds were locked forever and Bob lost money. Tools Used manually Recommended Mitigation Steps Remove the payable...

DoS with (Unexpected) revert or Gas Limit DoS on a Contract via Unbounded Operations

Lines of code Vulnerability details Impact According to SWC-113, external calls can fail accidentally or deliberately, which can cause a DoS condition in the contract. To minimize the damage caused by such failures, it is better to isolate each external call into its own transaction that can be...

redeem WIll Fail If There Is One tokenReceived Has Zero Balance

Lines of code Vulnerability details Impact redeem will always revert if there is one token received has zero balance, and user will not able redeem their token. So the token will lock in that contract. Proof of Concept Suppose, user A wants to redeem the token P, Q, R, so user A will call redeem...

transferFrom() failure in _safeTransferFrom() could drain the pair

Lines of code Vulnerability details Impact For some tokens, tokenCon.transferFrom could fail and return false but not revert. Some malicious user can abuse it the addLiquidity/addLiquidityCANTO function to perform failure transferFrom but still get the liquidity, and later remove liquidity to dra...

Invalid payout is accepted

Lines of code Vulnerability details Impact In callback function, getMarketInfoForPurchase also returns maxPayout as last argument. This is not compared against outputAmount which means if market asks for higher outputAmount then the contract will simply pay Similar instance Also check the...

[M1] quorumVotes() at NounsDAOLogicV2 returns zero for invalid proposalId

Lines of code Vulnerability details Impact External protocol or contract can be negatively impacted. PoC quorumVotes is external so it can be called from outside. At this time it returns zero for incorrect proposalId . function quorumVotesuint256 proposalId public view returns uint256 Proposal...