Constant product formula is not maintained in deposit() and withdraw() functions.

Lines of code Vulnerability details Impact As constant product formula is not followed, during deposit/withdraw, actualReserves - both actual NFT and BaseToken are updated but virtualReserves are not updated. This could lead to incorrect price deviation for the trader, most reverting their...

OperatorProposal.sol: Leftover ETH is not refunded to the msg.sender

Lines of code Vulnerability details Impact The OperatorProposal contract is a type of proposal that allows to execute operations on contracts that implement the IOperator interface. Upon execution of the proposal it might be necessary that the executor provides ETH. This is true especially when...

No slippage control for deposit() with the impact that a user deposits with expected high bond price might end up a deposit with the lowest bond price.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. There is no slippage control for deposit. Impact: a user deposits with expected high bond price might end up a deposit with the lowest bond price. Scenario: a depositor waits for the end of an epoch,...

In stake() function shares increase exponentially for the same amount of deposit as the totalSupply() increases, causing the loss for the initial stakers relative to later ones.

Lines of code Vulnerability details Impact Stake function don not allocate the safEth according to the totalShares, instead as more user deposit, later depositers get higher share of the value as compared to ealy depositers. Proof of Concept Consider Alice, Bob and Jenny want to stake their eth...

Spot UniswapV3 pricing for rETH when staking in SafEth can lead to loss of user funds

Lines of code Vulnerability details Impact An attacker can craft a set of transactions so that when they are depositing funds in the SafEth contract, using the stake function, they can understate the value of existing deposits preDepositPrice value, while overstating the value of their deposit...

Interactive `run` permission prompt spoofing via improper ANSI neutralization

Summary Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a opspawnchild or opkill prompt and replace it with any desired text. Details The main entry point comes down to the ability to override what the API control says 40process.js...

A POSITION WILL BE FULLY LIQUIDATABLE AS SOON AS IT BECOMES LIQUIDATABLE

Lines of code Vulnerability details Impact A specific position can be liquidated if canLiquidate returns true. However, the function logic of maxLiquidatableDebt is going to make it fully liquidatable even if safetyRatio == 1e18. Proof of Concept Let's assume the following setup: collRatio = 1.5e...

Incorrect use of the && Operator will allow anyone to fuse a new Namespace NFT

Lines of code Vulnerability details Impact Any caller can easily mint NFT if they provide a valid list of characters with the appropriate trays, the problem with this code is in this check if trayOwner != msg.sender && tray.getApprovedtrayID != msg.sender && !tray.isApprovedForAlltrayOwner,...

Unlimited minting of Canto Bio NFT

Lines of code Vulnerability details Impact There is no max limit on the number of Bio NFT that can be minted by a user. This allows an attacker to mint himself any amount of Bio NFT he want. Proof of Concept function testMint public string memory bio = "TEST BIO"; vm.prankalice; for uint i = 0; i...

Namespace.sol fuse() function incorrectly calculates fused bytes

Lines of code Vulnerability details Impact The fuse function in Namespace.sol incorrectly calculates fused bytes. The first parameter to the characterToUnicodeBytes function is font class, which is always set to 0. This leads to an incorrect calculation of the tokenToName value, resulting in a...

[H-01] User that fuse more tiles to Namespace NFT pay lesser fusing costs instead of greater

Lines of code Vulnerability details Impact User that fuses more tiles will pay lesser fusing costs to revenueAddress instead of higher cost as intended Proof of Concept Namespace.solL110-L114 /Namespace.sol 110: function fuseCharacterData calldata characterList external 111: uint256 numCharacters...

Wrong block number calculation

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The calculation for the block info is currentBlockNumber + 1 BLOCKINFOBLOCKNUMBERPART + newTimestamp. getBlockNumberAndTimestamp, getBlockTimestamp, getBlockNumber all incorrectly calculate the current...

Unchecked msg.value will lead to losing funs inside the contract

Lines of code Vulnerability details Impact While paying for the transaction, function payForTransaction bytes32, // txHash bytes32, // suggestedSignedHash Transaction calldata transaction external payable ignoreNonBootloader ignoreInDelegateCall //@audit-issue no checks that actulayy there is...

The price fee for fusion characters is incorrect.

Lines of code Vulnerability details Vulnerability details Price fee for fusion characters is incorrect. According to the docs Fusing To fuse a namespace NFT, the user specifies the trays and the tiles offsets within the trays to use. Note that the whole tray is always burned, even if you only use...

Chinese Hackers Exploiting 0-day Vulnerability in Fortinet Products

By Deeba Ahmed According to researchers, multiple Fortinet products were impacted by this vulnerability, including FortiManager, FortiGate, and FortiAnalyzer. This is a post from HackRead.com Read the original post: Chinese Hackers Exploiting 0-day Vulnerability in Fortinet Products...

Possible loss of rewards when staking non-component vaults

Lines of code Vulnerability details Impact Users could gain less rewards if they stake a non-component vault, as compared to reassembling their S1 Citizen with the vault and and staking it as a component vault. Vulnerability Details From the repository's README.md: S1 Citizens without a component...

Use the _assetTransferFrom function instead of _assetTransfer. This is because the tokens are held in the escrow contract, rather than being in the destination BYTES address, and thus require a transfer from the escrow contract to the recipient's address

Lines of code Vulnerability details Impact The msg.sender lose his stakedBytes From BYTES address not possible to send stakedBytes to msg.sender. The stakedBytes only help in escrow contract not in BYTES address. Proof of Concept function assetTransfer address asset, address to, uint256 amount...

User Rewards will be lost in case of Withdraw

Lines of code Vulnerability details Impact User loses his unclaimed rewards If user withdraw all of his staked tokens he won't be able to claim rewards Proof of Concept the point is used to calculate user rewards and when a user withdraw all of its staked tokens the point will be set to zero and...

Ability to receive LP rewards without having any LP staked

Lines of code Vulnerability details Impact The impact of this is high as a user is able to first stake LP tokens, then craftily withdraw them in specific increments without any change to their staking rewards. The user is able to get to a state in which they have 0 LP tokens staked, but have 0 LP...

Winnings might be unable to catch up with prize pot

Lines of code Vulnerability details Impact Profit may become ineffective, meaning that funds are effectively stuck in the contract. Proof of Concept Funds are owned by the Lottery and the only way out is through payouts. However, since the jackpot is bound by jackpotBound the expected payout taki...