rwar

Lines of code L1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assess...

Users can bypass distributions fees by ragequitting instead of using a formal distribution

Lines of code Vulnerability details Impact Distribution fees can be bypassed by ragequitting instead of distributing Proof of Concept address payable feeRecipient = feeRecipient; uint16 feeBps = feeBps; if tokenType == ITokenDistributor.TokenType.Native return distributor.createNativeDistribution...

TEST M

Lines of code Vulnerability details TEST Assessed type call/delegatecall --- The text was updated successfully, but these errors were encountered: All reactions...

new finding

Lines of code L2 Vulnerability details test Assessed type Decimal --- The text was updated successfully, but these errors were encountered: All reactions...

test with new label

Lines of code L1 Vulnerability details test Assessed type CanAuto --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #964 [1684819958119]

Judge has assessed an item in Issue 964 as 2 risk. The relevant finding follows: L1 --- The text was updated successfully, but these errors were encountered: All reactions...

TEST Med 2

Lines of code L1 Vulnerability details test medium Assessed type Access Control --- The text was updated successfully, but these errors were encountered: All reactions...

TEST-high risk

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assessed...

TEST-medium

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assessed...

New finding

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assessed...

Incorrect decimal handling in _startAuction, resulting in wrong auction.startBidBps

Lines of code Vulnerability details Shortfall.startAuction uses the oracle price of the underlying tokens to price the pool bad debt: Shortfall.sol 389: for uint256 i; i the price returned by priceOracle.getUnderlyingPrice has a number of decimals equal to 36 - vToken decimals. This means the...

User can bypass _ensureMaxLoops check

Lines of code Vulnerability details Impact The user can bypass ensureMaxLoops check in Comptroller.sol to add in accountAssets all possible markets through borrow functions of VToken.sol. Proof of Concept The user adds max number of markets through enterMarkets. Then user can add another markets...

ExtraordinaryFunding may fail due to a decrease in the treasury funds due to a StandardFunding new distribution round

Lines of code Vulnerability details Impact Users could spend gas and possibly other off chain resources voting on an ExtraordinaryFunding proposal which would later revert when executing. Proof of Concept If an ExtraordinaryFunding proposal requests an amount of tokens between 48.5% and 50% of th...

NOT CONFIRMED

Lines of code L1 Vulnerability details NOT CONFIRMED Assessed type Decimal --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 3 from #316 [1683219136420]

Judge has assessed an item in Issue 316 as 3 risk. The relevant finding follows: L-04 USE THE OPENZEPPELIN SAFECAST LIBRARY FOR CRITICAL FUNCTIONS 2 --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 3 from #635 [1683219244120]

Judge has assessed an item in Issue 635 as 3 risk. The relevant finding follows: Unsafe downcasting PrivatePool.sol - 230, 231 --- The text was updated successfully, but these errors were encountered: All reactions...

State variables are initialized in an upgradeable contract + there is constructor

Lines of code Vulnerability details Impact Due to a requirement of the proxy-based upgradeability system, no constructors can be used in upgradeable contracts. State variables are initialized in an upgradeable contract Proof of Concept See -upgradeableavoid-initial-values-in-field-declarations...

Updating a submission - testing is i can add a submission by team that was originally an issue for a single warden.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps testings...

Upgraded Q -> 2 from #882 [1683052821779]

Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: In function buy and sell if one royalty recipients reverts whole transaction will fail --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #882 [1683052816154]

Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: If royaltyFee 0 and recipient == address0 users will be overcharged --- The text was updated successfully, but these errors were encountered: All reactions...