Lender can stop others from offering higher rates.

Lines of code NFTLoandFacilitator.lend; L205 Vulnerability details Impact A lender using an upgradeable smart contract could stop other lenders from buying him out, essentially causing a DoS. Proof of Concept Lender uses an upgradeable smart contract that front runs competing lenders and upgrades...

Need to change the logic of smart contracts in the face of negative inflation

Lines of code Vulnerability details Impact Given that the possibility of negative inflation in the economy is not impossible even now observed in some countries, it is important to clearly explain to users the act of smart contracts against negative inflation. In the current logic of the VOLT...

vcon address change not persistent across protocol components

Lines of code Vulnerability details Impact vcon address is allowed to be updated by GOVERNOR in Core, however, this change will not be reflected in CoreRef.vcon. Moreover, since CoreRef.vcon cannot be updated due to contract design, it is also impossible to fix this manually. We are not yet sure...

Wrong modfier

Lines of code Vulnerability details Impact According to the comment at line 49 and the business logic of this smart contract, it is better to use "ISgoverner " or "onlyGoverner" modifier instead of "onlyOwner". Proof of Concept Tools Used : manual analysis Recommended Mitigation Steps changing...

Re-entrace danger in PCVDeposit

Lines of code Vulnerability details Impact A malicious contract can empty all the system if he get ETH with the function withdrawETH. The onlyPCVController call this function and send ETH to the malicious contract, and then the malicious can use delegatecall and pretend to be onlyPCVController, a...

Facilitator fee is higher than it should be if loan asset has fees on transfer

Lines of code Vulnerability details Impact When the lend asset is a token with fees on transfer, the facilitator fee is higher than it should be. The contract doesn't use the actual token amount it received but the one where the fees aren't subtracted yet. This causes the borrower to receive fewe...

use of transferFrom

Lines of code Vulnerability details Impact NFTLoanFaciltator.closeLoan function uses transferFrom to transfer the collateral to "sendCollateralTo" address and if the contract and is not aware of incoming ERC721 tokens, the sent tokens could be locked forever Proof of Concept Tools Used Manual...

Chain ID Is Not Resistant To Hard Fork and Other Token Supports In The Oracle Contract

Lines of code Vulnerability details Impact During the code review, It has been observed only the following chain ids are supported for the chainlink. 1 and 42 - The contracts are not upgradeable therefore If there is any hard fork or new chain support, the contract should be deployed again with...

Updating rate limit for addresses restores their entire buffer amount

Lines of code Vulnerability details Impact When the bufferCap is updated for an address in updateAddress, the address's allowed buffer bufferStored is replenished to the entire bufferCap. The address could frontrun the updateAddress call and spend their entire buffer, then the buffer is replenish...

CVE-2022-24787

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one en...

Design/Logic Flaw

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one en...

CVE-2022-24787 Incorrect Comparison in Vyper

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one en...

CVE-2022-24787 Incorrect Comparison in Vyper

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one en...

CVE-2022-24787

CVE-2022-24787 (Vyper) affects the Vyper language (Pythonic smart contract language for the EVM) in version 0.3.1 and earlier. The issue is that bytestrings can contain dirty bytes, causing word-for-word comparisons to yield incorrect results. Even without dirty nonzero bytes, two bytestrings may...

expiry is not work in contract

Reported by warden rayn in 98, duplicate of 28 Low Risk Findings - expiry is not work in contract In document, we define that: Expiry The expiry date of the market. If a market has not settled by its expiry date, it will automatically settle at the lower bound of its Valuation Range. But in...

Precision loss

Lines of code Vulnerability details Impact In line 729 of HolyPaladinToken.sol a huge precision loss occurs if dropDecreaseDuration is not a multiple of MONTH. In its current implementation dropDecreaseDuration / MONTH will get rounded down, which means that dropDecreaseDuration of 1 month and 29...

System could be wrapped and made useless without contract whitelisting

Lines of code Vulnerability details Impact Anyone could create a contract or a contract factory "PAL Locker" with a fonction to deposit PAL tokens through a contract, lock them and delegate the voting power to the contract owner. Then, the ownership of this contract could be sold. By doing so,...

Function getUserPastLock may return incorrect values

Lines of code Vulnerability details Impact userLocks array can contain elements with the same fromBlock properties, but different total locked amounts. This edge case is not considered in the implementation of getUserPastLock function, which returns a value as soon as it finds a UserLock with...

DropPerSecond is not updated homogeneously, the rewards emission can be much higher than expected in some cases

Lines of code Vulnerability details function updateDropPerSecond internal returns uint256 // If no more need for monthly updates = decrease duration is over ifblock.timestamp startDropTimestamp + dropDecreaseDuration // Set the current DropPerSecond as the end value // Plus allows to be updated i...

Setting the minter address to address(0) can lead to breaking the contract set.

Lines of code Vulnerability details Impact The highlighted issue can lead to breaking the functionality of the contract set. Proof of Concept At certain set functions in the codebase, we are allowing setting the values to address0 or the case where old address = new address. This was observed in...