Division round down 2 times may cause convertToShares calculation incorrect if underlying token with decimals less than 8.

Lines of code Vulnerability details Impact In case fCash has not matured yet, convertToShares may return incorrect value due to division round down 2 times. It may leads to the case that user need more amount of share than expected to withdraw assets. In wfCashERC4626.convertToShares function, it...

User can alter amount returned by redeem function due to control transfer

Lines of code Vulnerability details Impact Control is transferred to the receiver when receiving the ERC777. They are able to transfer the ERC777 to another account, at which time the before and after balance calculation will be incorrect. uint256 balanceBefore = IERC20asset.balanceOfreceiver; if...

Deposit and mint function will be rendered useless for users who are depositing using eth since balances will never be finalised

Lines of code Vulnerability details The penultimate function in NotionalV2.batchBalanceAndTradeAction calculates the withdrawals and finalises the balance as mentioned : but the following calculation will revert on an underflow since balanceState.netAssetTransferInternalPrecision is set to 0 in...

it's possible to initialize contract BkdLocker for multiple times by sending startBoost=0 and each time different values for other parameters

Lines of code Vulnerability details Impact function initialize of BkdLocker suppose to be called one time and contract initialize one time. but if it's called by startBoost=0 then it's possible to call it again with different values for other parameters. there are some logics based on the values...

_writeCheckpoint() in Gauge use wrong index to get prevVoteStatus

Lines of code Vulnerability details Impact All the Voting values calculated by writeCheckpoint when it's not first checkpoint is going to set to False instead of account's last vote and because vote has been used in earned and reward calculation so reward distribution is going to be wrong too...

Wrong calculation for the new rewardRate[token] can cause some of the late users can not get their rewards

Lines of code Vulnerability details uint bribeStart = block.timestamp - block.timestamp % 7 days + BRIBELAG; uint adjustedTstamp = block.timestamp = periodFinishtoken safeTransferFromtoken, msg.sender, addressthis, amount; rewardRatetoken = amount / DURATION; else uint remaining = periodFinishtok...

Multi-hop routes will leave a dust trail

Lines of code Vulnerability details Impact By calling RubiconMarket.buyid, quantity as a consequence of L239 and L241 with quantity = currentAmount - currentAmount expectedMarketFeeBPS / 10000 ...the fee calculated by the buy function amounts to: currentAmount - currentAmount expectedMarketFeeBPS...

Wrong fee calculation between Router & Market

Lines of code Vulnerability details Impact The wrong fee calculation can cause a loss to users' fund and this loss will be stuck in RubiconRouter Proof of Concept We have the default $feeBPS = 20, BPS = 10000$ Let's assume that alice call RubiconRouter.swappayamt=1000000 Through router, alice wil...

Wrong buy_amt_min calculation in RubiconRouter.swapEntireBalance for multi-hop swaps

Lines of code Vulnerability details Impact The buyamountmin value provided for the swap call is calculating too few fees for multi-hop swaps. Every swap within a multi-hop swap is taking fees. Currently, only a one-time fee is calculated on the basis of the swapEntireBalance function parameter...

Order Overflow

Lines of code Vulnerability details Impact In the partial fill orderStatus calculation, there could be an overflow in the numerator and denominator calculation. This overflow could lead a buyer to buy more NFT/Other tokens than order amount. First example of impact: An NFT seller has two orders:...

AuraLocker kick reward only takes last locked amount into consideration, instead of whole balance

Lines of code Vulnerability details The issue occurs in AuraLocker, when expired locks are processed via kicking, and if all the user locks have expired. In this scenario, to calculate the kick reward, processExpiredLocks multiplies the last locked amount by the number of epochs between the last...

PT-2022-6895 · Libtiff +8 · Libtiff +8

Name of the Vulnerable Software and Affected Versions: libtiff version 4.4.0rc1 Description: A flaw in the rotateImage function in the tiffcrop.c file at line 8621 can cause a program crash when reading a crafted input due to a sysmalloc assertion failure. This issue is related to an incorrect...

ConvexMasterChef: When _lpToken is cvx, reward calculation is incorrect

Lines of code Vulnerability details Impact In the ConvexMasterChef contract, a new staking pool can be added using the add function. The staking token for the new pool is defined using the lpToken variable. However, there is no additional checking whether the lpToken is the same as the reward tok...

ConvexMasterChef: When _lpToken is duplicated, reward calculation is incorrect

Lines of code Vulnerability details Impact Same as IDX-002 in In the ConvexMasterChef contract, a new staking pool can be added using the add function. The staking token for the new pool is defined using the lpToken variable. However, there is no additional checking whether the lpToken is already...

maxFee is not checked against a max value while being updated

187 comment Warden: catchup Lines of code Vulnerability details changeFee maxFee should be checked against a maximum value like 10% to make sure it is not set too high by mistake. Impact maxFee can be set beyond limits which would mess up fee calculations. Proof of Concept getTransferFee function...

GHSA-9QMM-4MFR-R3WJ Incorrect Calculation in solana_rbpf

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to...

Incorrect Calculation in solana_rbpf

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to...

CVE-2022-23066

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to...

Design/Logic Flaw

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to...

CVE-2022-23066 Solana rBPF - Incorrect Calculation in sdiv instruction

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to...