Upgraded Q -> M from 129 [1666359797557]

Judge has assessed an item in Issue 129 as Medium risk. The relevant finding follows: 1.use transfer to pay eth GolomTrader.sol payEther use transfer to pay eth , and receiver can be specified arbitrarily, it is recommended to use call to avoid a certain chance of failure due to 2300 gas fee...

Upgraded Q -> M from 868 [1666360678566]

Judge has assessed an item in Issue 868 as Medium risk. The relevant finding follows: Using .call instead of .transfer Currently it is using .transfer to transfer ETH payablepayAddress.transferpayAmt; Using deprecated transfer on address payable may revert in these cases: 1. The withdraw recipien...

Upgraded Q -> M from 236 [1666363743332]

Judge has assessed an item in Issue 236 as Medium risk. The relevant finding follows: ERC721 token can be lost in fillAsk PROBLEM When a user fills an ask order by calling fillAsk, the ERC721.transferFrom method is used to transfer the NFT to the receiver. Should the receiver be a smart contract...

Upgraded Q -> M from 921 [1666361310869]

Judge has assessed an item in Issue 921 as Medium risk. The relevant finding follows: 1. Should use call instead of transfer Line References GolomTrader.solL154 Impact The payableaddress.transfer function has a limit of 2300 gas source. If the receiver has a fallback/receive function that require...

Upgraded Q -> M from 612 [1666359673078]

Judge has assessed an item in Issue 612 as Medium risk. The relevant finding follows: NC-01 Replace assembly chainid with Solidity's chainId Description Retrieving the current chain id via the Yul chainid expression can be replaced with the Solidity native call to chainId. Findings...

Upgraded Q -> M from 873 [1666362235337]

Judge has assessed an item in Issue 873 as Medium risk. The relevant finding follows: Avoid payableaddress.transfer GolomTraderpayEther uses payableaddress.transfer to send native ETH. It's considered a best practice to avoid this pattern for ETH transfers, since it forwards a fixed gas stipend...

If L1GraphTokenGateway's outboundTransfer is called by a contract, the entire msg.value is blackholed, whether the ticket got redeemed or not.

Lines of code Vulnerability details The outboundTransfer function in L1GraphTokenGateway is used to transfer user's Graph tokens to L2. To do that it eventually calls the standard Arbitrum Inbox's createRetryableTicket. The issue is that it passes caller's address in the submissionRefundAddress a...

Lack of a contract existence check may lead to undefined behavior

Lines of code Vulnerability details Impact Low-level calls call/delegatecall/staticcall return true even if the account called is non-existent per EVM design. Solidity documentation warns: “The low-level functions call, delegatecall and staticcall return true as their first return value if the...

No withdraw mechanism for eth sent to GraphProxy contract

Lines of code Vulnerability details Impact The GraphProxy contract implements receive and fallback functions to receive funds. However, there is no method associated with a user to withdraw his funds which might be sent accidentally to the proxy contract, thus leading to most of the eth locked in...

The arithmetic operator can overflow

Lines of code Vulnerability details Impact It is possible to cause an integer overflow or underflow in the arithmetic operation. Proof of Concept Contract: GraphProxyAdmin Function name: getProxyPendingImplementationaddress PC address: 1898 Estimated Gas Usage: 1387 - 36513 In file:...

The arithmetic operator can overflow

Lines of code Vulnerability details Impact It is possible to cause an integer overflow or underflow in the arithmetic operation. Description An overflow/underflow happens when an arithmetic operation reaches the maximum or minimum size of a type. For instance if a number is stored in the uint8...

Possible loss of assets for seller through cross-contract re-entrancy

Lines of code Vulnerability details Impact BlurExchange.execute applies a reentrancyGuard modifier, however does not apply the Check-Effect-Interact pattern since cancelledOrFilledsellHash and cancelledOrFilledbuyHash are set to true after the transfers. This presents the risk of a cross-contract...

Wrong amount of ERC1155 token result in loss of funds for buyer

Lines of code Vulnerability details Impact In StandardPolicyERC1155 contract, the amount of ERC1155 token always return 1 instead of amount value in Order struct. The result is when ERC1155 orders is matched, buyers will only receive 1 token even they specify amount 1, which means loss of funds f...

BlurExchange Contract May Not Be Upgradeable

Lines of code Vulnerability details Vulnerability Details The BlurExchange is designed to be an implementation contract supporting an upgradeable feature. However, we found that some contracts define state variables without allocating the reserved storage slots gap which may impede the BlurExchan...

Missing check for address(0)

Lines of code Vulnerability details Impact Anyone can use address0 as a matchingPolicy contract Proof of Concept The Owner can invoke addPolicy with policy == address0 by mistake to the whitelistedPolicies and the malicious users could do bad things with matchingPolicy == address0 Recommended...

ExecutionDelegate can approve arbitrary calling contract

Lines of code Vulnerability details Impact Owner can steal users' funds and tokens. Proof of Concept The owner of ExecutionDelegate can approve any contract to call it, e.g. a malicious contract which can then drain all funds and tokens approved by users to ExecutionDelegate. Users should only...

The amount of an ERC1155 token should be checked.

Lines of code Vulnerability details Impact For NFT token of type ERC1155, there may be multiple tokens with the same tokenId. Therefore, when processing orders of type ERC1155, it is necessary to check not only whether the tokenId of the NFT for both buyers and sellers are matched, but also the...

Lack of check for contract existance can cause loss of funds during transfers

Lines of code Vulnerability details Impact The current transfers will not check if the to address is for an existing token contract. This can cause loss of funds if an user attempts to make a swap for a tokens added to a pool and destructed later. Proof of Concept TokenA gets added to a pool The...

Possible Integer OverFlow and UnderFlow on Multiple lines of AlgebraPool.sol

Lines of code Vulnerability details There are multiple possibilities for Integer OverFlow and UnderFlow when accounting is performed on AlgebraPool Contract. The above Permalinks will highlight the raw add and sub-operations without Safe Math. Also, the contract uses a solidity version only below...

ArtGobblers contract wouldn't receive a random seed forever by a malicious user.

Lines of code Vulnerability details Impact ArtGobblers contract wouldn't receive a random seed forever by a malicious user. Currently it can't execute revealGobblers and upgradeRandProvider when gobblerRevealsData.waitingForSeed == true. So if the contract fails to receive the random seed after...