Attacker can steal money from the initializer function

Lines of code Vulnerability details Impact Your Using old openzeplin Verision which the initializer function is vulnerable to and an attacker can call it twice after it’s been initliazed and since it approves max tokens to those contract. Which then after it’s first initialization the attacker...

Upgraded Q -> M from 155 [1655579831823]

Judge has assessed an item in Issue 155 as Medium risk. The relevant finding follows: ETH send return value is ignored while is gas limited The use of send / call to send ETH may have unintended outcomes on the eth being sent to the receiver. Eth may be irretrievable or undelivered if the...

Upgraded Q -> M from 44 [1655579898351]

Judge has assessed an item in Issue 44 as Medium risk. The relevant finding follows: 1. Usage of legacy ETH transfer function Risk Low Impact Contract ForgottenRunesWarriors for withdrawing ETH to vault uses send function, which has a fixed gas stipend and can fail. The reason behind this is that...

auraBAL can be stuck into the Strategy contract

Lines of code Vulnerability details Impact The internal harvest function defined is responsible to claim auraBAL from the aura locker and within the function it swaps them to auraBAL - BAL/ETH BPT - WETH - AURA, finally it locks AURA to the locker to increase the position. For claiming auraBAL it...

Fee-on-transfer support

Lines of code Vulnerability details Impact Every time transferFrom or transfer function in ERC20 standard is called there is a possibility that underlying smart contract did not transfer the exact amount entered. It is required to find out contract balance increase/de...

BADGER bribes can not be claimed

Lines of code Vulnerability details sendBadgerToTree will send BADGER twice and therefore fail. It is sending it to the BADGERTREE in sendBadgerToTree, and then continues to send the same amount to the vault in processExtraToken. Impact BADGER rewards cannot be claimed. The contract is trying to...

Fee-on-transfer support

Lines of code Vulnerability details Impact Every time transferFrom or transfer function in ERC20 standard is called there is a possibility that underlying smart contract did not transfer the exact amount entered. It is required to find out contract balance increase/decrease after the transfer to...

Upgraded Q -> M from 270 [1655579826704]

Judge has assessed an item in Issue 270 as Medium risk. The relevant finding follows: Gas stipend for payable.send may be too low for contract wallets ETH withdrawals in both the minter and token contracts use payableaddress.send to transfer ether to the vault address. If the configured vault is ...

Vulnerable OZ version [email protected] used

Lines of code Vulnerability details Impact An outdated and vulnerable OpenZeppelin version 3.4.0 is used. This dependency has a known high severity vulnerability: describes the possibility of initializer protected functions to be called twice, this would affect the MyStrategy.sol contract. See...

Upgraded Q -> M from 189 [1655579836940]

Judge has assessed an item in Issue 189 as Medium risk. The relevant finding follows: N02 Using send to send ETH could run out of gas. You have to be sure of the logic of the recipient. --- The text was updated successfully, but these errors were encountered: All reactions...

TimelockControllerEmergency: The sent ether may be locked in the OwnerProxy contract

Lines of code Vulnerability details Impact The call function in the TimelockControllerEmergency contract will send ether to the OwnerProxy contract, and the OwnerProxy contract will delegatecall the script contract. The two existing script contracts will neither use ether nor withdraw ether, whic...

Attacker can grief users from withdrawing their tokens and causing users to loose money

Lines of code Vulnerability details Impact balance of this contract of vault tokens in the require statement can stop users from withdrawing their tokens 2 issues: 1. vaultbalancebefore= balance of this contract from a vault tokens vaultamount=vaultbalancebefore- balance of vault right then when...

attacker can lock all the auraBAL rewards in contract address forever and they won't be accessible

Lines of code Vulnerability details Impact auraBAL token is in protected tokens list, so it can't be transferred to bribeProcessor by using sweepRewardToken. function harvest is supposed to call LOCKER.getReward and then swap received auraBAL rewards and deposit them in LOCKER, but it only can do...

All withdrawal functionality is paused when contract is paused

Lines of code Vulnerability details Impact When the strategy contract is paused, all withdrawal functionality will be paused. Based on the comments in MyStrategy.sol and baseStrategy.sol, withdrawToVault should not be affected by the pause functionality. This is not the case due to the...

The Oracle address settings for the PriceOracle.sol contract are not checked for ZERO Address, and will not do the expected work if the prophecy machine address is set to Zero address (which will be populated with 0 by default if not passed to the constructor).

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The getPrice function of the PriceOracle contract internally calls getPriceFromAdapters to get the price, but does not check that the adapters are not set to Zero Address, so when the address in the...

Integer overflow can affect router balances

Lines of code Vulnerability details Impact Integer overflow can affect router balances. Proof of Concept The repayAavePortal method of the PortalFacet contract subtracts the balance within an unchecked region, but this balance is not checked beforehand to be greater than the amountIn. unchecked...

you can mint any amount of tokens and steal eth from the contract

Lines of code Vulnerability details Impact attacker calls the mintViaAsset function if attacker want to lend eth that you suppy the contract , it wil take eth make it into weth then what you lend . you can mint how many tokens you want because if iseth is true it just converts the eth to weth and...

Residual Allowance Might Allow Tokens In SetToken To Be Stolen

Lines of code Vulnerability details Proof-of-Concept Whenever mintFCashPosition function is called to mint new fCash position, the contract will call the approve function to set the allowance to maxSendAmount so that the fCash Wrapper contact can pull the payment tokens from the SetToken contract...

Users Might Not Be Able To Purchase Or Redeem SetToken

Lines of code Vulnerability details Proof-of-Concept Whenever a setToken is issued or redeemed, the moduleIssueHook and moduleRedeemHook will be triggered. These two hooks will in turn call the redeemMaturedPositions function to ensure that no matured fCash positions remain in the Set by redeemin...

cause an attacker to get a better deal on intrest rate on borrwoing and lending or cause txs' to revert

Lines of code Vulnerability details Impact if the variable maturity in getMaturity function is a big number that gets put into uint40 and since its to big of a number it will revert because solidity ^0.8.0 dosn't allow overflow and on deployment hasMatured can be true because it very close to the...