Solmate's safeTransfer can result in failed transfer with low level call and won't revert as it does not check the codesize of to address, which may lead to loss of funds

Lines of code Vulnerability details The following contract use solmate's SafeTransferLib : solmate/utils/SafeTransferLib.sol Solmate's safeTransfer / safeTransferFrom uses inline assembly call to transfer ether from contract to receiver. According to Solidity Docs the call may return true even if...

Unchecked External Call Vulnerability in ownerOf Function Call.

Lines of code Vulnerability details Impact In the worst-case scenario, if the ownerOf function call reverts due to a security vulnerability in the ERC721 contract, the caller's data could be manipulated, and their funds could be at risk. This could lead to a loss of funds for users who have...

No-check taht amounts are less than reserves

Lines of code Vulnerability details Impact There is no check that the amount for the flashloan is actually available in the contract. It is checked that it should be 0 but not than reserves. Eventually, the function will revert because the funds are not there and the funds are not in the contract...

Malicious user can create a dummy Lendgine contract by mimicing a salt with same encoding format but using a malicious AMM invariant function

Lines of code Vulnerability details Impact Lendgine contract address is created using a salt that is generated by a hash of pool parameters in Factory.sol. A malicious user can create a Lendgine exploit contract that uses the salt generated by exact same encoding but this contract inherits a Pair...

Possibly Susceptible to Reentrancy Attack

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. No protection against reentrancy attacks, which could allow an attacker to exploit the contract's logic by calling functions in the contract before the original call is completed. Proof of Concept To...

Anyone can withdraw all the WETH sent to Payment contract

Lines of code Vulnerability details Impact Anyone can withdraw all the WETH sent to Payment contract Proof of Concept 1. Someone send WETH to Payment contract 2. Attacker will call unwrapWETH with amountMinimum = WETH balance of Payment contract and recipient = any attacker controlled address 3...

Anyone can withdraw all the ETH sent to Payment contract

Lines of code Vulnerability details Impact Anyone can withdraw all the ETH sent to Payment contract Proof of Concept 1. Someone send ETH to Payment contract 2. Attacker will call refundETH 3. Payment contract will transfer all ETH to attacker's address Tools Used Manual Analysis --- The text was...

Anyone can transfer any tokens balance of Payment contract

Lines of code Vulnerability details Impact Anyone can transfer any tokens balance of Payment contract Proof of Concept 1. Someone send some tokens to Payment contract 2. Attacker will call sweepToken with token = token address, amountMinimum = Token balance of Payment contract and recipient = any...

withdrawFee() can be called multiple times by any user when quest has ended making it possible to drain contract and leave users unable to claim rewards

Lines of code Vulnerability details Impact The withdrawFee function in the Erc20Quest contract can be called multiple times. The modifier onlyAdminWithdrawAfterEnd is applied to the function which only makes it possible to call it after the end time of a quest. It should be noted that any user is...

Wrongly implemented modifier allow anybody to mint receipts.

Lines of code Vulnerability details Impact Quest rewards can be claimed by anybody without completing any task. RabbitHoleReceipt.onlyMinter modifier purpose is to allow only designated addresses to mint new receipts like QuestFactory smart contract. But since the input is not validated anybody c...

Owner can stop user from claiming rewards in the Erc1155Quest

Lines of code Vulnerability details Impact After completing their tasks users can mint a new receipt token which they can later claim reward with it using the claim function, this function can not be called when the Quest contract is paused so the users can't claim when quest contract is paused...

Protocol fees can be withdrawn multiple times in Erc20Quest

Lines of code Vulnerability details The withdrawFee function present in the Erc20Quest contract can be used to withdraw protocol fees after a quest has ended, which are sent to the protocol fee recipient address: function withdrawFee public onlyAdminWithdrawAfterEnd...

withdrawRemainingTokens() in the Erc1155Quest withdraws all tokens and does not consider the amount of unclaimed tokens

Lines of code Vulnerability details Impact The withdrawRemainingTokens function in the Erc1155Quest contract does not consider the amount of unclaimed tokens. When the owner calls the function when the quest has ended, all tokens belonging to the contract will be withdrawn. Any user who has not y...

Wrongly implemented modifier allow everybody to mint Rabbit Hole tickets.

Lines of code Vulnerability details Impact As specified on RabbitHole C4 contest page, RabbitHoleTickets smart contract 'is an 1155 reward contract used by the RabbitHole team.' Meaning that the assets managed by this smart contract have value. Moreover this contract implements ERC-2981: NFT...

Malicious user can send the quest reward tokens to the protocol fee contract preventing users from claiming their rewards.

Lines of code Vulnerability details Impact Malicious user can take advantage of the function withdrawFee after the quest end time and successfuly send the quest reward tokens to the protocol fee contract preventing users from claiming their rewards. Proof of Concept Every receipt minted should...

Mitigation of M-03: See comments

Lines of code Vulnerability details The PR does not follow the recommended mitigation from the finding, and instead still allows under-priced bids to be added if the total value being added is at least a multiple of the minimum reserve price. Impact If, for example, the reserve price is 10 Eth,...

Lack of flexibility in updating cycle length leading to potential contract redeployment.

Lines of code Vulnerability details Impact function cycleOfuint32 timestamp private view returns uint32 cycle unchecked return timestamp / cycleSecs + 1; and function currCycleStart private view returns uint32 timestamp uint32 currTimestamp = currTimestamp; // slither-disable-next-line weak-prng...

Unpacking the "0x1626ba7e" Mystery: The Risks of Unidentified Fixed Values in Smart Contracts - loss of funds

Lines of code Vulnerability details Impact The use of a fixed value in the require statement without understanding its significance creates a security vulnerability in the contract. An attacker could manipulate the returned value to bypass the require statement and execute malicious code. This ca...

User might not be able to claim refund when the NFT is bought for less than the minimum reserve price

Lines of code Vulnerability details Impact User might not be able to claim refund when the NFT is bought for less than the minimum reserve price because the minReservePrices is rounded down, which make the contract refund sightly more eth to each user. In most case, the last user will not be able...

Loss of ETH for proposer when it is a contract that doesn't have fallback function.

Lines of code Vulnerability details The issue that is described in code-423n4/2022-12-tessera-findings40 was not mitigated and still applies like it is described there. --- The text was updated successfully, but these errors were encountered: All reactions...