Community/Team owner can steal gobbler by sending it to arbitrary address

Lines of code Vulnerability details Impact A malicious owner can steal all of its reserved gobbler. This is possible because owner can send reserved gobbler by withdraw function to ANY ARBITRARY ADDRESS. Proof of Concept owner can set any address to to parameter of withdraw function of...

Lack of address check for contract ownership changes

Lines of code Vulnerability details Impact Not Checking for zero address input can cause to lose of ownership by accident . Proof of Concept owner try to change ownership to a zero address and it cause to lose of funds . Tools Used Recommended Mitigation Steps Add a check that address in not zero...

[M3] It is impossible to recover stucked non complying ERC-20 tokens

Lines of code Vulnerability details Impact Contract frxETHMinter is unable to recover tokens like USDT PoC Tokens that return void on transfer, that is, those who do not follow ERC20 standard will revert when you try to assign the output to a boolean variable. This is the case in you function...

frxETHToken user was freeze into the contract and loss of user fund.

Lines of code Vulnerability details Impact Whoever was deposit frxETHToken user was freeze into the contract and loss of user fund. Proof of Concept on that line of : uint256 sfrxethrecieved = sfrxETHToken.depositmsg.value, recipient; it frxETHToken was approved, if approved succeed that would...

[H1] Owner of frxETHMinter can rug pull the contract

Lines of code Vulnerability details Impact Owner of the contract is able to leave with all the tokens and ETH of the contract, which makes protocol trustless PoC You have implemented a function to function recoverEtheruint256 amount external onlyByOwnGov bool success, = addressowner.call value:...

Emergency functions recoverEther recoverERC20, moveWithheldETH and setWitholdRatio should not allow owner to call them

Lines of code Vulnerability details Impact True trustlessness is hard, but there's not much point in having open source smart contracts unless the goal is achieved completely. The moment a vector exists where a rug pull could occur a user should be rightly suspicious. Although TimelockController ...

Use of transfer() instead of call() to send eth

Lines of code Vulnerability details Use of transfer instead of call to send eth Impact Use of transfer might render ETH impossible to withdraw because after istanbul hardfork, there is increases in the gas cost of the SLOAD operation and therefore breaks some existing smart contracts.Those...

Risk of ETH funds Rug Pull in the moveWithheldETH and recoverEther functions

Lines of code Vulnerability details Impact In the frxETHMinter contract both the owner and governance timelock have the power to call the functions moveWithheldETH and recoverEther, those functions allow the transfer of the ETH from frxETHMinter to the owner or a given account, this means that th...

Upgraded Q -> M from 264 [1663928566317]

Judge has assessed an item in Issue 264 as Medium risk. The relevant finding follows: L-05 Single-step Vetoer transfer is unsafe If the newVetoer is set to the incorrect address, the functionality will be unretrievable. 1 instance of this issue has been found: L-05 NounsDAOLogicV2.solL839-L845...

Can overflow linear vest calculation and lock up funds

Lines of code Vulnerability details Impact If a Claim object for a user has a large enough vesting time and/or linear vesting amount, then that object can get into a state such that the calculations in baseVestedAmount overflow. If the baseVestedAmount calculations overflow, then the associated...

numTokensReservedForVesting is not compared with contract balance

Lines of code Vulnerability details Impact In VTVLVesting contract, the claims are created without comparing the numTokensReservedForVesting variable to the contract balance. If the sum of all user vesting tokens is below this param then the contract will be insolvent to be withdrawn. Proof of...

createClaim can be circumvented

Lines of code Vulnerability details Impact VTVLVesting.sol has createClaim function for the admins to create claims. However, a malicious admin vector exists inside. The project gives some powerfull access to the admins for some reason as stated on the contest page. And a good intention is to emi...

admin still can mint token even if limit is reached

Lines of code Vulnerability details Impact In VariableSupplyERC20Token.sol theres a mint function that can be operate only by admin. The function should operate in 2 ways. IF maxSupplywas declared inconstructor, the admincan only mint as long as the token less thanmaxSupply/mintableSupply. OR IF...

DoS with underlying Rebasing/Deflationary tokens

Lines of code Vulnerability details M -01 Issues with underlying Rebasing/Deflationary tokens Problem When underlying token is Rebasing/Deflationary at some point users will not be able to withdraw, because of the rebasing mechanics balance of tokens of the smart contract may change over time and...

User will lose rewards

Lines of code Vulnerability details Impact User will lose there rewards even when vesting period has completed. Also the reward will get stuck in the contract with no one able to retrieve them Proof of Concept 1. Admin creates a new claim using createClaim function function createClaim address...

Outdated Claims can be created which will potentially inflate the vested amounts

Lines of code Vulnerability details Overview In creating claims, the VTVLVesting contract uses various time related variables including startTimestamp and endTimestamp which determines when the linear vesting starts and ends consecutively. This is visible in the createClaim , createClaimsBatch an...

numTokensReservedForVesting is not compared with contract balance

Lines of code Vulnerability details Impact In VTVLVesting contract, the claims are created without comparing the numTokensReservedForVesting variable to the contract balance. If the sum of all user vesting tokens is below this param then the contract will be insolvent to be withdrawn. Proof of...

error in calculation of vested amount

Lines of code Vulnerability details Impact The function vestedAmount can return a wrong value of vested amount. Proof of Concept The function vestedAmount calculates the vested amount of a recipient at a given time,referenceTs. The problem is that if the referenceTs is in the past and the user ha...

Loss of vested amounts

Lines of code Vulnerability details Impact Vesting is a legal term that means the point in time where property is earned or gained by some person. The VTVLVesting contract defines: a start time Claim::startTimestamp and an end time Claim::endTimestamp at which vesting starts and ends for a entitl...

Remove the withdrawOtherToken function (phishing)

Lines of code Vulnerability details Impact This function can be only called by admins. Remove the withdrawOtherToken function to prevent you from phishing attacks. Proof 1. Attacker will send the fake tokens to your contract address. 2. Now there are 100% chances, admin of vesting contract will b...