3583 matches found
Vault: Swaps at parity with swap fee = withdrawal fee
Handle hickuphh3 Vulnerability details Impact The vault treats all assets to be of the same price. Given that one can also deposit and withdraw in the same transaction, this offers users the ability to swap available funds held in the vault at parity, with the withdrawal protection fee 0.1%...
Vault does not normalize decimal on withdrawing
Handle jonah1005 Vulnerability details Impact The vault does not normalize decimals when a user withdraws the token. When a user has 100e18 shares, he can withdraw all usdc/ usdt from the token. The liquidity of USDC/USDC would be drained. I consider this is a high-risk issue. Proof of Concept...
Vault.withdraw mixes normalized and standard amounts
Handle cmichel Vulnerability details The Vault.balance function uses the balanceOfThis function which scales "normalizes" all balances to 18 decimals. for uint8 i; i 0 controller.withdrawoutput, toWithdraw; uint256 after = IERC20output.balanceOfaddressthis; uint256 diff = after.subbalance; if dif...
Controller.setCap sets wrong vault balance
Handle cmichel Vulnerability details The Controller.setCap function sets a cap for a strategy and withdraws any excess amounts diff. The vault balance is decreased by the entire strategy balance instead of by this diff: // @audit why not sub diff? vaultDetailsvault.balance =...
token -> vault mapping can be overwritten
Handle cmichel Vulnerability details One vault can have many tokens, but each token should only be assigned to a single vault. The Manager contract keeps a mapping of tokens to vaults in the vaultstoken = vault map, and a mapping of vault to tokens in tokensvault = token. The addToken function ca...
Controller.withdrawAll sets wrong vault balance
Handle cmichel Vulnerability details The Controller.withdrawAll decreases the vault balance by amount, the want token amount that has been withdrawn from the strategy and transferred to the vault. Note that amount gets overwritten in the convert != address0 branch and is a convert token value...
Vault: Withdrawal amount isn't un-normalized
Handle hickuphh3 Vulnerability details Impact In withdraw, the withdrawal amount is the proportion of the normalized amounts of all the tokens in the vault and its strategies. However, this amount isn't un-normalized to the output token's decimals, thus leading to an erroneous token amount being...
Missing check for duplicate token in addToken
Handle 0xRajeev Vulnerability details Impact addToken does not check for token being added a duplicate of what was already added. If a duplicate token is added, removeToken only removes the first matching token and the later duplicates still remain. With the vaulttoken deleted, this may lead to...
Vault: Withdrawals can be frontrun to cause users to burn tokens without receiving funds in return
Handle hickuphh3 Vulnerability details Impact Let us assume either of the following cases: 1. The vault / protocol is to be winded down or migrated, where either the protocol is halted and withdrawAll has been called on all active strategies to transfer funds into the vault. 2. There are 0...
wildfly-core: Invalid Sensitivity Classification of Vault Expression
A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly...
Reordering of strategies on Controller does not reorder strategies in Harvester
Handle itsmeSTYJ Vulnerability details Impact The harvester might harvest the wrong strategy because the array of strategies that it stored in its storage is not in the same order as the one stored in the controller. Recommended Mitigation Steps Add a similar reorder strategy function in...
Security Bulletin: Multiple Vulnerabilities Have Been Identified In IBM Security Verify Privilege Vault
Summary Multiple vulnerabilities identified in IBM Security Verify Privilege Vault previously known as IBM Security Secret Server have been addressed in the release 11.0. Vulnerability Details CVEID: CVE-2021-20569 DESCRIPTION: IBM Security Verify Privilege could allow an attacker to enumerate...
Deposits into vaults are not tracked at a token level
Handle itsmeSTYJ Vulnerability details Impact If the strategy used accepts multiple tokens, a user can deposit in a cheaper token and withdraw in a more expensive token because the vault only tracks ownership based on how many shares they own. Proof of Concept 1. An approved strategist adds 2...
earn results in decreasing share price
Handle jonah1005 Vulnerability details Impact For a dai vault that pairs with NativeStrategyCurve3Crv, every time earn is called, shareholders would lose money. about 2% There're two issues involved. The Vault contract and the controller contract doesn't handle the price difference between the wa...
Controller transfer extra token on withdrawing tokens
Handle jonah1005 Vulnerability details Impact The Controlle�r's function withdrawaddress token, uint256 amount should return whatever amount of the token user/vault asks. However, it tries to withdraw strategy.want token and convert it. Take for example, when a user/vault calls withdrawdai, 100,...
WhatsApp to Finally Let Users Encrypt Their Chat Backups in the Cloud
WhatsApp on Friday announced it will roll out support for end-to-end encrypted chat backups on the cloud for Android and iOS users, paving the way for storing information such as chat messages and photos in Apple iCloud or Google Drive in a cryptographically secure manner. The optional feature,...
Vault treats all tokens exactly the same that creates (huge) arbitrage opportunities.
Handle jonah1005 Vulnerability details Impact The v3 vault treats all valid tokens exactly the same. Depositing 1M DAI would get the same share as depositing 1M USDT. User can withdraw their share in another token. Though there's withdrawalProtectionFee 0.1 percent, the vault is still a no slippa...
removeToken would break the vault/protocol.
Handle jonah1005 Vulnerability details removeToken would break the vault. Impact There's no safety check in Manager.sol's removeToken. Manager.solL454-L487 1. The token would be locked in the original vault. Given the current design, the vault would keep a ratio of total amount to save the gas...
