There is no deadline for swaps

Lines of code Vulnerability details Impact If the receiver that is specified in the IBC callback doesn't have enough tokens for interacting with the Canto network defaults at 4 CANTO, then the middleware is going to swap the tokens for some CANTO tokens on the Canto network and convert the rest t...

Arbitrary delegatecalls from LlamaAccount can be used to steal assets

Lines of code Vulnerability details Impact Using delegatecall to call arbitrary contracts is highly dangerous as it can be used to steal assets. An attacker could sneak in a contract that steals all the assets owned by the LlamaAccount contract. Proof of Concept Below is a diff to the existing...

ETH CAN GET LOCKED IN THE CONTRACT DURING THE EXECUTION OF _swap() FUNCTION

Lines of code Vulnerability details Impact In the JBXBuybackDelegate delegate contract, if the swap option is selected after comparing the quote, the JBXBuybackDelegate.swap function will swap the data.amount.value amount of ETH in the following pool.swap call. try pool.swap recipient: addressthi...

Delegate should check that terminal is operating with ETH as the terminal token

Lines of code Vulnerability details Delegate should check that terminal is operating with ETH as the terminal token The JBXBuybackDelegate implementation is only prepared to operate with ETH as the terminal token. The implementation should check that the JuiceBox terminal matches this case. Impac...

Improper configuration in JBXBuybackDelegate can cause swaps to fail everytime

Lines of code Vulnerability details Impact Improperly configured direction of swap in JBXBuybackDelegate can cause the calls to swap tokens in Uniswap V3 pool to fail everytime. So if the ideal path is token swap over minting, swaps will fail and new project token will be minted instead Proof of...

Verify the correspondence between trading pairs and pools

Lines of code Vulnerability details Impact It may cause the correct ProjectToken to be locked, and transfer the wrong ProjectToken to the beneficiary. Proof of Concept Add test USDC after line 78 in the test file. IERC20 usdc = IERC200xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48; Modify line 142...

Swaps in Uniswap V3 may be partial

Lines of code Vulnerability details Swaps in Uniswap V3 may be partial Uniswap V3 pools may execute a swap partially, in which case it may leave an unhandled amount of WETH in the JBXBuybackDelegate contract. Impact Swaps in Uniswap V3 can eventually be executed partially, if liquidity is not...

Setting the slippage tolerance incorrectly can result in users losing funds

Lines of code JBXBuybackDelegate.solL156 Vulnerability details Impact Since the slippage parameter is also passed from the frontend, we need to validate the magnitude of the parameter value，if slippage == SLIPPAGEDENOMINATOR ，users may be vulnerable to sandwich attacks during the Uniswap swapping...

Incorrect setting of sqrtPriceLimitX96 in protocol

Lines of code Vulnerability details Impact The pool.swap function in the swap attempts to execute a swap. As the code below ,The sqrtPriceLimitX96 is set based on the value of projectTokenIsZero. If projectTokenIsZero is true, sqrtPriceLimitX96 is set to TickMath.MAXSQRTRATIO - 1; otherwise, it i...

contract might not function due to lack of funds

Lines of code Vulnerability details Impact when the contract receives a Uniswap pool callback the contract performs some checks before it proceeds to call the weth.deposit with a msg.value that is equal to amountToSend to wrap eth and transfer it to the pool, however the contract is not guarantee...

Lack checks if Pool deployed by the canonical UniswapV3Factory in uniswapV3SwapCallback

Lines of code Vulnerability details Impact Loss of deserved tokens or DoS when users use this contract. Proof of Concept According to the uniswap docs: The caller of this method must be checked to be a UniswapV3Pool deployed by the canonical UniswapV3Factory. However, there is no check in this...

Contributors will be unable to fund a project if UNISWAP token swapping is recommended over minting in JBXBuybackDelegate data source

Lines of code Vulnerability details Impact A core function of the juice-buyback contract, which is to maximise the project tokens received by the contributor, won't work whenever a swap from Uniswap V3 pool provides more tokens over minting because the transaction will revert. This can cause the...

JBXBuybackDelegate.didPay() allows for positive slippage theft

Lines of code Vulnerability details Impact The JBXBuybackDelegate.didPay calls swap which utilizes the Uniswap's swap function. JBXBuybackDelegate incorporates a negative slippage check in uniswapV3SwapCallback. However, it fails to consider the deadline parameter of the transaction. The deadline...

Wrong use of the deadline for the swapExactTokensForTokens function

Lines of code Vulnerability details Impact deadline: Unix timestamp after which the transaction will revert. uniswap api docs. Venus sets the deadline to block.timestamp, then the transaction will never revert. Proof of Concept Transactions may be blocked resulting in transactions using unintende...

Missing transaction expiration check result in asset tokens selling at a lower price

Lines of code Vulnerability details Impact Selling of asset tokens misses the transaction expiration check, which may lead to reward tokens being sold at a price that's lower than the market price at the moment of a swap. Proof of Concept The swapAsset function, which is responsible for selling...

Mitigation of M-08: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-08: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings685 Comments First, there is a clear error in the associated description of mitigation: "Use Chainlink to get rETH". Using Chainlink to obtain the...

Mitigation of M-09: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-09: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings673 Even though the contest repository revision 431a4b751fb7e184b847a41509b97e4d67971d2f doesn't mention a changeset for M-09, I assume the...

Mitigation of M-04: Mitigation error

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-04: Mitigation error Link to Issue: code-423n4/2023-03-asymmetry-findings932 Comments Even though the original issue is mitigated, as the exchange through Uniswap V3 has been completely removed in favor of using...

TEST FINDING

Lines of code Vulnerability details ISSUE FOR TESTING PURPOSES Assessed type Uniswap --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #463 [1682585731493]

Judge has assessed an item in Issue 463 as 2 risk. The relevant finding follows: L-08 Swapping in Reth.sol may be sub-optimal The Reth pool uses the Weth/Reth 0.05% fee pool to swap between weth and reth. I recommend using the balancer pool to swap instead as it has 80M liquidity compared to...