Functions like AutoPxGmx.withdraw and AutoPxGmx.redeem do not provide effective slippage control

Lines of code Vulnerability details Impact As shown below, calling the AutoPxGmx.withdraw and AutoPxGmx.redeem functions would execute compoundpoolFee, 1, 0, true, which uses the hardcoded 1 as the amountOutMinimum input of the AutoPxGmx.compound function to further call the...

AlgebraPool.sol#L501-L507 : position.fees are updated without checking whether the amount value is greater than zero or not

Lines of code Vulnerability details Impact Incorrect fee update if any one of the amount is zero. Proof of Concept if amount0 | amount1 != 0 position.fees0 = positionFees0 - amount0; position.fees1 = positionFees1 - amount1; if amount0 0 TransferHelper.safeTransfertoken0, recipient, amount0; if...

computeAddress does not follow the standard procedure to compute the address. The contract can not create pool for some pairs due to hash collision

Lines of code Vulnerability details Impact Poor source of randomness, an attacker can easily decipher the computed address. The contract can be easily tricked. This can cause hash collision, due to this, for some pairs, the contract can not create pool. Proof of Concept AlgebraFactory.solL123 : T...

reserve0CumulativeLast is incorrectly calculated

Lines of code Vulnerability details Impact It was observed that both reserve0CumulativeLast and reserve1CumulativeLast are incorrectly calculated. Reference can be taken from Uniswap contract which calculates it correctly at Proof of Concept 1. The reserve0CumulativeLast is currently calculated i...

Swap execution will revert with invalid block.timestamp deadline when leveraging position.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. In the code, we hard code the swap deadline to block.timestamp, which is easlity expired. ISwapperswapperAddress.swapExactTokensForTokens borrowAmount, amountCollateralOutMin, path, addressthis,...

Malicious code in uniswap.org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df9e81c2cfb7449079ce04d2d397b16d6610f7a1d6316d8632fab2f5a979b1fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Uniswap V3 LPs Lose Millions in Fake Token Phishing Attack

By Deeba Ahmed Binance CEO Changpeng Zhao CZ said in a Tweet that their intel unit identified an exploit on Uniswap… This is a post from HackRead.com Read the original post: Uniswap V3 LPs Lose Millions in Fake Token Phishing Attack...

MAL-2022-5205 Malicious code in pancake_uniswap_validators_utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07f34b82556bcb804369bc6e0306a07a2682db655d115596f860b7eb29a461f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uniswap-v3-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c561e581d3a7b2b22aeaf477bb47282a0921d11de5d5f263f6f0fb1a20b53061 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uniswap-v2-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36809731348bb0b16418c6c21f3074d63d258f4cd3e03ebab01a693c2f77c204 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6785 Malicious code in uniswap-v3-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c561e581d3a7b2b22aeaf477bb47282a0921d11de5d5f263f6f0fb1a20b53061 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6784 Malicious code in uniswap-v2-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36809731348bb0b16418c6c21f3074d63d258f4cd3e03ebab01a693c2f77c204 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Wrong Deadline

Lines of code Vulnerability details the deadline is the timestamp after which the transaction will revert. the goal of this field is that the caller can set a deadline for the transaction so the transaction will not succeed in any arbitrary time in the future, and after this deadline, they can...

BathToken with initial liquidity of 1 wei causes very expensive share price leading to precision errors and loss of funds

Lines of code Vulnerability details Impact The creator of a new BathToken is able to maliciously manipulate the share price by providing lowest possible amount 1 wei of liquidity initialLiquidityNew and then artificially blowing up the BathToken token balance. Following depositors will loose thei...

YieldManager's distributeYield can be subject to sandwich attacks

Lines of code Vulnerability details distributeYield uses Uniswap swaps via convertAssetToExchangeToken and Curve swaps via convertToStableCoin. UniswapAdapter and CurveswapAdapter do use Oracle for price estimation, but distributeYield calls use hard coded 5% SLIPPAGE, which is wide enough to mak...

YieldManager: Uniswap token swaps through fixed path may break yield distribution

Lines of code Vulnerability details Details & Impact All harvested yield tokens are swapped through the Uniswap adapter to USDC. While out of scope, the Uniswap adapter code is relevant here, as I note that the path taken for the swap would be assetFrom - WETH - assetTo unless assetFrom is alread...

New YVault depositors can be attacked by depressing share decimals

Lines of code Vulnerability details Impact An attacker can become the first depositor for a recently created YVault contract, providing a tiny amount of token by calling deposit1 raw values here, 1 is 1 wei, 1e18 is 1 token if it is 18 decimals. Then the attacker can directly transfer, for exampl...

Not calling approve(0) before setting a new approval causes the call to revert when used with Tether (USDT)

Lines of code Vulnerability details Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's approve function will revert if the current approval is not zero, to protect against front-running changes of...

Flash loan price manipulation in purchasePyroFlan()

Handle sirhashalot Vulnerability details Impact The comment on line 54 of FlanBackstop.sol states "the opportunity for price manipulation through flash loans exists", and I agree that this is a serious risk. While the acceptableHighestPrice variable attempts to limit the maximum price change of t...

Two pairs can have same tokens

Handle sirhashalot Vulnerability details Impact The createLPoolPair function in ControllerV1.sol tries to prevent a pair from being create if it already exists. It does this with the statement requirelpoolPairstoken0token1.lpool0 == address0 || lpoolPairstoken1token0.lpool0 == address0, 'pool pai...