CVE-2020-37289

A flaw was found in Vyper. The compiler does not validate the upper bounds of smaller integer types returned from external contract interfaces, allowing 8-bit values to be stored in larger 256-bit variables without range verification. A malicious smart contract can exploit this flaw by returning...

Calc token amount can be manipulated

Lines of code Vulnerability details Impact function calcDepositInOneCoin uint2563 memory arr private view returns uint256 return liquidityPool.calctokenamountarr, true; This function is being used to calculate slippage, return value calctokenamount can be manipulated as described in POC section,...