Unchecked return value from ERC20

Handle cmichel Vulnerability details Vulnerability Details The ERC20.transfer and ERC20.transferFrom functions return a boolean value indicating success. This parameter needs to be checked for success. According to the standard the return value must be checked for true, otherwise the transfer wil...

Critical uberOwner address changes should be a two-step process

Handle 0xRajeev Vulnerability details Impact As specified, uberOwners of Factory, Orderbook and Treasury have the highest privileges in the system because they can upgrade contracts of market, Nfthub, order book, treasury, token and factory which form the critical components of the protocol. The...

Flows can bypass market and global pause

Handle 0xRajeev Vulnerability details Impact Ability to pause all token transfers and all state changes for contracts is a “guarded-launch” best-practice for emergency situations for newly launched projects. The project implements this using a marketsPaused flag per market and a globalPause flag...

Missing Factory-only access check leads to loss of funds

Handle 0xRajeev Vulnerability details Impact The Market sponsoraddress sponsorAddress, uint256 amount function is an externally callable function that is specified to be callable only by the Factory contract during market creation, as documented in the Natspec @dev comment: "called by Factory...

transferFrom result not checked

Handle gpersoon Vulnerability details Impact The function deposit of SafeERC20.sol relies on the fact that transferFrom will revert if it can't transfer the erc20 tokens. However, depending on the ERC20 token, this doesn't happen and you have to check the result of transferFrom. With the wrong...

anyone can call function sponsor

Handle pauliax Vulnerability details Impact This function sponsor should only be called by the factory, however, it does not have any auth checks, so that means anyone can call it with an arbitrary sponsorAddress address and transfer tokens from them if the allowance is 0: /// @notice ability to...

Supreme Court narrows CFAA

The US Supreme Court issued its long-awaited-by-cybersecurity-nerds opinion on Van Buren v. United States. The case examined whether it was a violation of the Computer Fraud and Abuse Act CFAA for a police officer to access a law enforcement database to obtain information, which the officer then...

Uniswap Oracle uses wrong prices

Handle cmichel Vulnerability details The Uniswap oracle uses a mock contract with hard-coded prices to retrieve the price which is not feasible in production. Not sure if this is part of the contest, this will probably still be changed? But note that even when using the "real deal"...

Duplication of Balance

Handle 0xsomeone Vulnerability details Impact It is possible to duplicate currently held ink or art within a Cauldron, thereby breaking the contract's accounting system minting units out of thin air. Proof of Concept The stir function of the Cauldron, which can be invoked via a Ladle operation,...

Witch can't give back vault after 2x grab

Handle gpersoon Vulnerability details Impact The witch.sol contract gets access to a vault via the grab function, in case of liquidation. If the witch.sol contract can't sell the debt within a certain amount of time, a second grab can occur. After the second grab, the information of the original...

pendingWithdrawals not decreased after a withdraw

Handle shw Vulnerability details Impact The variable pendingWithdrawals in the contract Withdrawable is not decreased after the function withdraw is called, which causes the return value of function getReserveBalance less than it should be. This bug could cause incorrect results in several critic...

Incorrect type conversion in the contract ABC makes users unable to burn FSD tokens

Handle shw Vulnerability details Impact The function calculateDeltaOfFSD of contract ABC incorrectly converts an int256 type parameter, reserveDelta, to uint256 by explicit conversion, which in general results in an extremely large number when the provided parameter is negative. The extremely lar...

Incorrect type conversion in the contract ABC makes users unable to burn FSD tokens

Handle shw Vulnerability details Editing on a previous post to correct some details Impact The function calculateDeltaOfFSD of contract ABC incorrectly converts an int256 type parameter, reserveDelta, to uint256 by explicit conversion, which in general results in an extremely large number when th...

The function liquidateDai() fails

Handle s1m0 Vulnerability details Impact liquidateDai try to swap DAI to ETH through uniswap using swapExactTokenForETH. Before calling swapExactTokenForETH the smart contract should approve uniswap router to use amount of DAI. Also as for documentation If the to address is a smart contract, it...

Eth may get stuck in contract

Handle JMukesh Vulnerability details Impact Istanbul hardfork increases the gas cost of the SLOAD operation and therefore breaks some existing smart contracts. In file withdrawable.sol, contract uses transfer to send eth from contract to EOA due which eth can get stuck. reason behind this is, aft...

Unbounded loop in _removeNft could lead to a griefing/DOS attack

Handle shw Vulnerability details Impact Griefing/DOS attack is possible when a malicious NFT contract sends many NFTs to the vault, which could cause excessive gas consumed and even transactions reverted when other users are trying to unlock or transfer NFTs. Proof of Concept 1. The function...

Unchecking the ownership of mph in function distributeFundingRewards could cause several critical functions to revert

Handle shw Vulnerability details Impact In contract MPHMinter, the function distributeFundingRewards does not check whether the contract itself is the owner of mph. If the contract is not the owner of mph, mph.ownerMint could revert, causing functions such as withdraw, rolloverDeposit,...

Can lock more tokens than in contract

Handle cmichel Vulnerability details Vulnerability Details The Visor.timeLockERC20 allows locking any amount of tokens exceeding the contract's token balance. Impact The recipient might think that they'll receive the tokens after expiry but it could be that the contract is already out of tokens b...

Can lock more tokens than in contract

Handle cmichel Vulnerability details Vulnerability Details The Visor.timeLockERC20 allows locking any amount of tokens exceeding the contract's token balance. Impact The recipient might think that they'll receive the tokens after expiry but it could be that the contract is already out of tokens b...

Lack of address input validation will lock tokens in contract

Handle 0xRajeev Vulnerability details Impact Functions timeLockERC721 and timeLockERC20 are used by the vault owner to timelock tokens in the vault with a specified recipient address as the only one with the right to withdraw after timelock expiry. If a zero/incorrect recipient address is used he...