Staking Funds vault's LP holder cannot claim EIP1559 rewards after derivatives are minted for a new BLS public key that is not the first BLS public key registered for syndicate

Lines of code Vulnerability details Impact After the derivatives are minted for the first BLS public key registered for the syndicate, the Staking Funds vault's LP holder can claim the corresponding EIP1559 rewards received by the syndicate. However, after the derivatives are minted for a new BLS...

Upgraded Q -> M from #336 [1668467652322]

Judge has assessed an item in Issue 336 as M risk. The relevant finding follows: L-1: Volatility accumulator can be be prevented from decaying by way of dust transactions There is no required minimum swap amount for updating the volatility accumulated. The fp.time is always updated during a swap...

Repaying a line of credit with a higher than necessary claimed revenue amount will force the borrower into liquidation

Lines of code Vulnerability details A borrower can repay parts of a credit line with the SpigotedLine.useAndRepay function. This function will use amount of unusedTokenscredit.token as a repayment. However, if amount exceeds the principal and the accrued interest, credit.principal will underflow...

Misleading code in BorrowController including no validation of the amounts to be borrowed.

Lines of code Vulnerability details Impact BorrowController contract checks if any contract is in the borrow list. However, due to the use of msg.sender == tx.origin statement, it returns true for the EOA addresses. It's also observed that any amount of borrowing is acceptable by the...

Reuse of previous voting difference in extendPledge() charges too much fees

Lines of code Vulnerability details Description In Warden Pledge, creators can extend the life span of an existing pledge using extendPledge. Here's the implementation: uint256 addedDuration = newEndTimestamp - oldEndTimestamp; ifaddedDuration maxTotalRewardAmount revert...

MEV: Operator can bribe miner and steal honest operator's bond amount if gas price went high

Lines of code Vulnerability details Description Operators in Holograph do their job by calling executeJob with the bridged in bytes from source chain. If the primary job operator did not execute the job during his allocated block slot, he is punished by taking a single bond amount and transfer it...

HIGH: Honest operator can lose their bonded amount although gas price was unacceptable during their slot

Lines of code Vulnerability details Description Operators in Holograph do their job by calling executeJob with the bridged in bytes from source chain. If the primary job operator did not execute the job during his allocated block slot, he is punished by taking a single bond amount and transfer it...

Upgraded Q -> M from 336 [1666364078201]

Judge has assessed an item in Issue 336 as Medium risk. The relevant finding follows: Using transfer For Sending Ether Permalinks Description The transfer and send functions forward a fixed amount of 2300 gas. Historically, it has often been recommended to use these functions for value transfers ...

StandardPolicyERC1155.sol doesn't validate the order.amount properly.

Lines of code Vulnerability details Impact StandardPolicyERC1155.sol doesn't validate the order.amount properly. This contract is used to check a policy for matching orders of ERC1155 tokens. But it doesn't check the amount of ERC1155 token properly and traders might lose their funds unexpectedly...

Buyers will lose an amount of their funds for only one ERC115 token

Lines of code Vulnerability details Impact By using StandardPolicyERC1155.sol as a matchingPolicy for the order. The buyer will transfer an amount of funds ETH or WETH for 2 or more tokens, but he will receive only 1 token. Proof of Concept in case the buyer has set Input.Order.amount 1. Let’s sa...

execute does not work for ERC1155 tokens orders where amount > 1

Lines of code Vulnerability details Impact StandardPolicyERC1155 functions canMatchMakerBid and canMatchMakerBid always return amount == 1, regardless of the function arguments. This means that calling execute on an agreed order of ERC1155 token with an amount 1 will always transfer amount == 1 o...

The execution of an order transfers 1 token regardless of Order.amount

Lines of code Vulnerability details Impact An order can be placed for an arbitrary amount, which is relevant for ERC1155. But when matched and executed only 1 token is transferred. This can lead to problems with accounting for the user, expecting a transfer of Order.amount tokens, potentially wit...

Amount of ERC1155 tokens transferred is always 1.

Lines of code Vulnerability details Impact When a user signs an order to buy multiple ERC1155 tokens the amount of tokens transferred is hardcoded to be 1. This means although they expected to get n number of tokens for the total price of X they only get 1 and pay the total amount of X ETH. Proof...

withheld_amt calculation is done after minting frxETHToken tokens

Lines of code Vulnerability details Proof of concept The submit method in frxETHMinter.sol has the following code // Give the sender frxETH frxETHToken.mintermintrecipient, msg.value; // Track the amount of ETH that we are keeping uint256 withheldamt = 0; if withholdRatio != 0 withheldamt =...

recoverEther not updating currentWithheldETH breaks calculation of withheld amount for further deposits

Lines of code Vulnerability details The emergency exit function recoverEther allows the owner to retrieve the ETH in case an issue were to happen. The problem is that this function does not update currentWithheldETH. This means upon deposit starting again after the emergency recovery,...

Users cannot use mintWithSignature() function in most cases

Lines of code Vulnerability details Impact Function sfrxETH.mintWithSignature allows users to approve and mint in one transaction. Users will provide input param shares and function will calculate what assets amount needed to be approved in case approveMax = false. uint256 amount = approveMax ?...

Overflow in _baseVestedAmount() prevents claims to be retrieved

Lines of code Vulnerability details Impact Rewards of high value will be unable to be withdrawn since claimableAmount will revert. Proof of Concept In line 176, if we assume there's a claim of a token with 18 decimals and a vesting of 1 year, which is a realistic vesting period that can be observ...

Missing sanity check

Lines of code Vulnerability details Impact Missing sanity check on linearVestAmount Proof of Concept 1. Visit here 2. You are missing the sanity check on user inputted linearVestAmount 3. You need add the check on zero amount --- The text was updated successfully, but these errors were encountere...

Overflow in amount calculation can lead to users not being able to withdraw their funds

Lines of code Vulnerability details Impact The amounts of token are saved in uint112 variables. The baseVestedAmount, which calculates the amount of token that was vested for the user given a timestamp, contains the following line that calculates the relative amount using the time passed from the...

error in calculation of vested amount

Lines of code Vulnerability details Impact The function vestedAmount can return a wrong value of vested amount. Proof of Concept The function vestedAmount calculates the vested amount of a recipient at a given time,referenceTs. The problem is that if the referenceTs is in the past and the user ha...