Shortfall.sol#updateNextBidderBlockLimit may cause the current auction to end immediately

Lines of code Vulnerability details Impact File: Shortfall.sol 293 function updateNextBidderBlockLimituint256 nextBidderBlockLimit external 294 checkAccessAllowed"updateNextBidderBlockLimituint256"; 295 requirenextBidderBlockLimit != 0, "nextBidderBlockLimit must not be 0"; 296 uint256...

# riskFund.poolReserves return the token amount & its compaired with the USD value (units are not same)

Lines of code Vulnerability details riskFund.poolReserves return the token amount & its compaired with the USD value units are not same poolReserves in RiskFund.sol returns the token amount. But its compaired with the incentivizedRiskFundBalance which is in USD value. Proof of Concept 403 uint256...

USDC blacklisted accounts can DOS the bidding system in Shortfall

Lines of code Vulnerability details Impact Shortfall contract is used to clear off any pool bad debt via auction. If the debt reached its mimimum value, anybody can start off the auction and place the bid. Attacker can bid with tokene.g. USDC, USDT that have a contract level admin controlled...

Precision differences when calculating the _startAuction of funds accumulated in RiskFund

Lines of code Vulnerability details Impact When calculating startAuction uint256 usdValue in RiskFund, Auction state divides the value of each market in the vToken list in token list precision. This skew is fine for most tokens but will cause problems with certain token pairs. Proof of Concept Wh...

Malicious actor can win auction unfavorably to the protocol by block stuffing

Lines of code Vulnerability details Vulnerability Details When protocol’s bad debt is auctioned off with 10% incentive at the beginning. A user who gives the best bid, wins. The auction ends when at least one account placed a bid, and current block number is bigger than nextBidderBlockLimit:...

Bad debt bidders’ funds are locked forever when Shortfall address is changed during ongoing debt auction

Lines of code Vulnerability details Vulnerability Details When the protocol accrues bad debt, it can be auctioned off to anyone who is willing to pay. Each user wanting to participate in the auction has to lock their bid in Shortfall contract: function placeBidaddress comptroller, uint256 bidBps...

jnjonlineauction.com Cross Site Scripting vulnerability OBB-3248365

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Params of Lien struct are not emitted when lien is created making it difficult to track

Lines of code Vulnerability details Impact Protocol does not store any information about Lien. When users want to interact, they have to send the whole Lien struct along with lienId, and the protocol will verify if this data is correct by hash. This approach reduces onchain storage and can save a...

Upgraded Q -> 3 from #460 [1677510923458]

Judge has assessed an item in Issue 460 as 3 risk. The relevant finding follows: Lines of code Vulnerability details Impact The safeTransferFrom function on the ClearingHouse is normally used when an OpenSea auction successfully ends and the required ERC20/WETH have been transferred to the...

priceTarget is inconsistent in StabilizerNode.stabilize

Lines of code Vulnerability details Impact priceTarget is inconsistent in StabilizerNode.stabilize so stabilize can do auction instead of selling malt and vice versa. Proof of Concept In StabilizerNode.stabilize, there is an early check using shouldAdjustSupply function. if...

An early check logic in StabilizerNode.stabilize prevents possible stabilization.

Lines of code Vulnerability details Impact An early check logic in StabilizerNode.stabilize prevents possible stabilization. Proof of Concept In StabilizerNode.stabilize, there is an early check logic for exchangeRate and auction state. If shouldAdjustSupply returns false, stabilize will end...

Upgraded Q -> H from #296 [1674743769839]

Judge has assessed an item in Issue 296 as H risk. The relevant finding follows: Lines of code Vulnerability details A malicious liquidator could cause the NFT auction to fail and steal the collateral after end of auction. Impact Anyone can act as a liquidator and trigger the liquidation of the...

Managing Incomplete Transactions in the _assertConsiderationLengthIsNotLessThanOriginalConsiderationLength Function

Lines of code Vulnerability details Impact In the assertConsiderationLengthIsNotLessThanOriginalConsiderationLength function, the revertMissingOriginalConsiderationItems function is called if the supplied consideration item total is less than the original consideration item total. However, there ...

settleAuction() Check for status errors

Lines of code Vulnerability details Impact ClearingHouse.safeTransferFrom to execute successfully even if there is no bid Proof of Concept settleAuction is called at the end of the auction and will check if the status is legal function settleAuctionuint256 collateralId public if...

LienToken: Lender and liquidator can collude to block auction and seize collateral

Lines of code Vulnerability details If a lender offers a loan denominated in an ERC20 token that blocks transfers to certain addresses for example, the USDT and USDC blocklist, they may collude with a liquidator or act as the liquidator themselves to prevent loan payments, block all bids in the...

Attacker can fake an ERC20 token as the paymentToken and call ClearingHouse.safeTransferFrom() to prematurely settle the auction, preventing the actual auction from completing

Lines of code Vulnerability details Impact ClearingHouses are deployed for each new loan and settle payments between Seaport auctions and Astaria Vaults if a liquidation occurs. However, due to the lack of proper data validation in the current implementation, anyone can fake a token and transfer ...

Operator can buy papr with PaprController as the debtor.

Lines of code Vulnerability details Impact This requires that an NFT is in auction. When an operator calls purchaseLiquidationAuctionNFT the price variable is determined by a call to purchaseNFTAndUpdateVaultIfNeeded which calls purchaseNFT which calls safeTransferFrom on the auctionAssetContract...

NFT owner only is allowed for liquidation, this may not work for all the cases, the debt can be insolvent

Lines of code Vulnerability details Impact When bad debt is not paid or not able to recover the through auction of NFT, then the debt will be insolvent. Proof of Concept Contract allows for liquidation to recover the debt. Also, it has the auctioning mechanism to recover the debt by selling the...

Liquidation logic is incorrect in some conditions

Lines of code Vulnerability details Impact Because purchaseLiquidationAuctionNFT function clears remaining debt of debtor if he has no more collateral, it's possible that when 2 auctions exists in same time, liquidation logic will not work properly and debt will be nullified before last auction i...

Initial value of auction starter discount is set wrong

Lines of code Vulnerability details Impact The protocol offers a discount for auction starters when purchasing the liquidated NFT as an incentive for users to start an auction. I believe the intended discount should be 10%, but is currently implemented at 90%. 90% is too massive a discount for th...