Eth sent to Timelock will be locked in current implementation

Lines of code Vulnerability details Impact Eth sent to Timelock will be locked in current implementation. I came across this problem while playing around with the governance contract. Proof of Concept Setup the governance contracts GovernorBravoDelegate, Timelock Send eth to timelock contract Set...

Able to mint any amount of PT

Lines of code Lender.solL192-L235 Lender.solL486-L534 Lender.solL545-L589 Vulnerability details Impact Some of the lend functions do not validate addresses sent as input which could lead to a malicous user being able to mint more PT tokens than they should. Functions affect: Illuminate and Yield...

Cannot mint to exactly max supply using _mint function

Lines of code Vulnerability details Impact Cannot mint to exactly max supply using mint function Proof of Concept requiretotalSupply MAXSUPPLY, "Max supply"; if totalSupply == MAXSUPPLY this assert will be failed and reverted. But is shouldn't be reverted as totalSupply == MAXSUPPLY is valid. Too...

Staking: Attacker can stake very few tokens for others to increase the lock time of others' tokens.

Lines of code Vulnerability details Impact In the stake function of the Staking contract, anyone can stake tokens for others. And each time a token is staked, the lock time of all tokens is increased. This allows an attacker to stake few tokens for others to increase the lock time of others'...

first user can steal everyone else's tokens

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. A user who joins the systems first stakes first can steal everybody's tokens by sending tokens to the system externally. This attack is possible because you enable staking a small amount of tokens. Proo...

Only the state() of the latest proposal can be checked

Lines of code Vulnerability details Impact state function cannot view the state from any proposal except for the latest one. Proof of Concept requireproposalCount = proposalId && proposalId initialProposalId, "GovernorBravo::state: invalid proposal id"; Currently proposalCount needs to be bigger ...

_transferNFTs doesn't revert for bad tokens

Lines of code Vulnerability details Impact transferNFTs checks if an item is ERC721 or ERC1155 by using IERC165item.collection.supportsInterface.... function transferNFTs address from, address to, OrderTypes.OrderItem calldata item internal if IERC165item.collection.supportsInterface0x80ac58cd...

Wrong gasCost calculation per order

Lines of code Vulnerability details Impact During a match, there's some accounting on how much gas we're spending, so that the executor can be reimbursed. The gas cost is split between multiple orders, computing the difference between the gas at the start and at the end. The gas at the start is...

Timelock able to be bypassed because of wrong check in LibDiamond

Lines of code Vulnerability details Impact In the walkthrough video, it said that the upgrades of Diamond must go through a proposal window with a delay of 7 days. Upgrade should be done by first call proposeDiamondCut and then wait 7 days and call diamondCut. But this timelock can be bypassed...

Loss of yield can occur due to not specifying minAmountsOut when exiting BAL/ETH pool

Lines of code Vulnerability details Impact When exiting the BAL/ETH pool, due to not specifying anything for minAmountsOut an attacker can frontrun the transaction and cause a large change in price in the pool. This in turn leads to a large impermanent loss which is realised when the strategy bur...

Yield can be lost due to not specifying limit when transferring WETH to Aura

Lines of code Vulnerability details Impact In the harvest function, when the contract swaps WETH to Aura, limit is set to 0 allowing an attacker to front run the transaction and cause substantional loss of yield. swapSingleSwap singleSwap, FundManagement funds, uint256 limit, uint256 deadline...

attacker can lock all the auraBAL rewards in contract address forever and they won't be accessible

Lines of code Vulnerability details Impact auraBAL token is in protected tokens list, so it can't be transferred to bribeProcessor by using sweepRewardToken. function harvest is supposed to call LOCKER.getReward and then swap received auraBAL rewards and deposit them in LOCKER, but it only can do...

Approving from non-zero to non-zero allowance will revert with OZ's safeApprove()

Lines of code Vulnerability details Impact Transaction reverting. Proof of Concept OZ's implementation of safeApprove would throw an error if an approve is attempted from a non-zero value "SafeERC20: approve from non-zero to non-zero allowance": require value == 0 || token.allowanceaddressthis,...

Contracts are allowed to lock funds

Lines of code Vulnerability details Impact In current scenario, it is not checked whether the account locking the amount is a contract or a normal user. A malicious user can simply lock the amount in a contract and later transfer/sell this contract to another user who will then own the locked...

First depositor can break minting of shares

Lines of code Vulnerability details Impact The attack vector and impact is the same as TOB-YEARN-003, where users may not receive shares in exchange for their deposits if the total asset amount has been manipulated through a large “donation”. Proof of Concept In BathToken.sol:569-571, the...

Anyone can cancel orders from the router and get the tokens

Lines of code Vulnerability details Impact Anyone can cancel orders from the router and get the tokens Proof of concept -A user makes a WETH order from the router -Any attacker can call the cancel function with the order ID and get all the unfilled funds from the order Basically orders in the...

Title: Yield can be unfairly divided because of MEV/Just-in-time stablecoin deposits

Lines of code Vulnerability details Impact An attacker can use MEV via gas auction or Flashbots or control of miners to cause an unfair division of yield. By providing a very large relative to the size of all other stablecoin deposits combined stablecoin deposit Just-in-Time before an admin's cal...

Ether can be locked in the ConvexCurveLPVault contract without a way to retrieve it

Lines of code Vulnerability details Impact If a borrower deposits Curve LP tokens into the ConvexCurveLPVault contract via the payable function GeneralVault.depositCollateraladdress asset, uint256 amount and accidentally sends a non-zero Ether value with it, then the Ether value sent will be lock...

Strike price curve of getDutchAuctionStrike is not what users expect

Lines of code Vulnerability details Note: This submission contains links to a private fork of the contest repo. User code423n4 has been added as a collaborator in order to view. Impact Function getDutchAuctionStrike does not implement the function that Option buyers would expect. They probably...

Option buyers might loose funds due to vault owner's manipulation

Lines of code Vulnerability details Impact Option buyers might loose funds due to vault owner's manipulation Proof of Concept Alice creates a vault for her high valued NFT with a low price. Bob buys the option and sends premium. Alice buys the option from Bob by using an other EOA. Bob re-buys th...