Voting tokens may be lost when given to non-EOA accounts

Lines of code Vulnerability details Impact veNFTs may be sent to contracts that cannot handle them, and therefore all rewards and voting power, as well as the underlying are locked forever Proof of Concept The original code had the following warning: @dev Safely transfers tokenId token from from ...

Incorrect msg.value usage could lead to fund loss

Lines of code Vulnerability details Impact The burnToTarget function is using msg.value in a loop which is passed to swapAll function of swapperRouter. Since msg.value amount will not change within loop, contract will end up using its own ETH Proof of Concept 1. User calls burnToTarget function...

Voting Escrow System could be wrapped and made useless without contract whitelisting

Lines of code Vulnerability details Impact Anyone could create a contract or a contract factory, say “Velo Locker" with a fonction to deposit VELO tokens through a contract, lock them and delegate the voting power to the contract owner. Then, the ownership of this contract could be sold, or the...

VotingEscrow's merge and withdraw aren't available for approved users

Lines of code Vulnerability details Users who are approved, but do not own a particular NFT, are supposed to be eligible to call merge and withdraw from the NFT. Currently burn, used by merge and withdraw to remove the NFT from the system, will revert unless the sender is the owner of NFT as the...

Gauge: Attacker can call notifyRewardAmount function to insert malicious token to prevent reward distribution

Lines of code Vulnerability details Impact The notifyRewardAmount function of the Gauge contract can be called by anyone, and can insert any token when rewards.length MAXREWARDTOKENS. And the notifyRewardAmount function of the Gauge contract will call the addRewardToken of the Bribe contract to a...

Increase voting power by tokenizing the address that locks the token

Lines of code Vulnerability details Impact Without restriction on the type of address that lock the token, a bad actor could lock the token through the smart contract. Doing so enable him to make the lockedToken becomes liquidate by tokenize his smart contract which defeat the purpose of the...

ConvexMasterChef's deposit and withdraw can be reentered drawing all reward funds from the contract if reward token allows for transfer flow control

Lines of code Vulnerability details Reward token accounting update in deposit and withdraw happens after reward transfer. If reward token allows for the control of transfer call flow or can be upgraded to allow it in the future i.e. have or can introduce the beforetokentransfer, afterTokenTransfe...

Impossible Clearance of Delegate

Lines of code Vulnerability details ALR-01M: Impossible Clearance of Delegate | File | Lines | Type ---|---|--- AuraLocker.sol | L464-L509 | Code Functionality Description The delegate function disallows clearance of any existing delegation, thereby forcing the user to retain a delegate active...

Integer overflow will lock all rewards in AuraLocker

Lines of code Vulnerability details Impact There is a potential overflow in the rewards calculations which would lead to updateReward always reverting. The impact of this overflow is that all reward tokens will be permanently locked in the contract. User's will be unable to call any of the...

AuraClaimZap may transfer CVX tokens to itself which become locked in the contract

Lines of code Vulnerability details Impact During AuraClaimZap.claimExtras if the option LockCvx is set to false then the contract will transfer CVX tokens from the msg.sender to this contract without forwarding them on to the user. There is no way to retrieve these funds from the protocol and...

gemachain-bpf-loader-program (1.8.0), lido (1.1.0-patch.1) +42 more potentially affected by CVE-2022-31264 via solana_rbpf (>=0.1.5, <=0.2.24)

solanarbpf CARGO version =0.1.5, =1.2.3, =0.1.1, =0.1.4, =0.1.0, =1.0.2, =3.0.1, =1.6.16, =1.6.16, =1.2.3, =1.2.4 and more Source cves: CVE-2022-31264 Source advisory: OSV:GHSA-FFX3-8QVM-PQ3J...

ConvexMasterChef: When _lpToken is cvx, reward calculation is incorrect

Lines of code Vulnerability details Impact In the ConvexMasterChef contract, a new staking pool can be added using the add function. The staking token for the new pool is defined using the lpToken variable. However, there is no additional checking whether the lpToken is the same as the reward tok...

ConvexMasterChef: When _lpToken is duplicated, reward calculation is incorrect

Lines of code Vulnerability details Impact Same as IDX-002 in In the ConvexMasterChef contract, a new staking pool can be added using the add function. The staking token for the new pool is defined using the lpToken variable. However, there is no additional checking whether the lpToken is already...

Griefing attack by transferring aTokens to the contract

Originally part of a QA report by Tadashi 69 Griefing attack by transferring aTokens to the contract Summary: tokenToShares uses the following formula for computing the total shares of an user: return supply == 0 ? tokens : tokens.mulsupply.divaToken.balanceOfaddressthis; An attacker wishing to...

contractcateringmagazine.co.uk Cross Site Scripting vulnerability OBB-2621814

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[gALCX.sol] Attacker can make the contract unusable when totalSupply is 0

Lines of code Vulnerability details Impact An attacker can make the contract unusable when totalSupply is 0. Specifically, bumpExchangeRate function does not work correctly which results in making stake, unstake and migrateSource functions that do not work as expected. Proof of Concept Here are...

A well financed attacker could prevent any other users from minting synthetic tokens

Lines of code Vulnerability details Impact In the AlchemistV2 contract, users can deposit collateral to then borrow/mint the synthetic tokens offered by the protocol. The protocol also defines a minting limit that specifies how many synthetic tokens can be minted in a given time period. This exis...

If totalShares for a token falls to zero while there is pendingCredit the contract will become stuck

Lines of code Vulnerability details Impact It is possible for the contract to become stuck and unable to perform any actions if the totalShares of a yield token fall to zero while there is some pendingCredit still to be paid. It will then be impossible to call deposit or withdraw functions, mints...

User does not get funds if sending ETH in LidoVault.sol fails, funds stay suck in the contract

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. If the user uses smart contract to interact with the protocol with no receive/ payable fallback function, sending of ETH to the user will fail and the ETH would stay in the contract and withdraw action...

[WP-H5] LidoVault.sol Wrong implementation can cause the users to lose their funds when withdrawing ETH

Lines of code Vulnerability details function withdrawFromYieldPool address asset, uint256 amount, address to internal override returns uint256 address LIDO = addressesProvider.getAddress'LIDO'; if asset == address0 // Case of ETH withdraw request from user, so exchange stETH - ETH via curve uint2...