Unsafe mint is a reentrancy door

Handle pedroais Vulnerability details Impact Dangerous external calls in the middle of various state changes could cause reentrancy issues since there is no reentrancy guard in any functions. Proof of Concept When users call the deposit or sponsor functions a deposit NFT is minted. The safeMint...

Missing reentrant check can be abused by increasing total share, before transfering underlying token

Handle Fitraldys Vulnerability details Impact When interacting with the vault contract, the user can call the deposit function, however this can be used to reenter this function because the deposit function will eventually call depositors.mint and in the mint function inside depositors will call...

[WP-H2] NonUSTStrategy.sol Improper handling of swap fees allows attacker to steal funds from other users

Handle WatchPug Vulnerability details NonUSTStrategy will swap the deposited non-UST assets into UST before depositing to EthAnchor. However, the swap fee is not attributed to the depositor correctly like many other yield farming vaults involving swaps ZapIn. An attacker can exploit it for the sw...

Reentrancy vulnerability allows attacker to gain more shares than deserved

Handle harleythedog Vulnerability details Impact In Vault.sol, the deposit function is the external function that allows transferring underlying tokens to mint position NFTs. The deposit function first calls createDeposit which creates the position/determines how many shares to allocate, and then...

Claimer can reenter contract on deposit withdrawal

Handle kenzo Vulnerability details Upon withdrawal of deposit, the claimer will be called with onDepositBurned. This happens after the claimer shares have been updated, but before the underlying has been sent away from the contract. Therefore the claimer can reenter the contract, at an intermedia...

Fee-on transfer tokens not supported

Handle pmerkleplant Vulnerability details Impact There exist ERC20 tokens that charge a fee for every transfer. This kind of token does not work correctly with the PoolTemplate::deposit function. Proof of Concept The PoolTemplate::deposit function mints an amount of iTokens based on the function'...

_transferAndCheckUnderlying doesn't work with fee-on-transfer tokens

Handle harleythedog Vulnerability details Impact There are several ERC20 tokens that take a small fee on transfers/transferFroms known as "fee-on-transfer" tokens. Most notably, USDT is an ERC20 token that has togglable transfer fees, but for now the fee is set to 0 see the contract here: . In th...

When a user performs a withdrawal operation, a rollback that is not considered by the program may be triggered.

Handle ACai Vulnerability details Impact When the Vault contract deposits all/most of the token into the strategy contract, so that the remaining tokens in the Vault contract are less than the user's deposit, the user's withdrawal operation will result in a rollback that is not considered by the...

Re-entracy leading to increasing points in undesired way

Handle hack3r-0m Vulnerability details Current state: the attacker has a few nfts minted already by locking position call lock function with very high duration and very high amount from a contract attacker has control of this contract It will pass the non-re-entrant check and call lock function...

The reentrancy vulnerability in _safeMint can allow an attacker to steal all rewards

Handle cccz Vulnerability details Impact There is a reentrancy vulnerability in the safeMint function function safeMint address to, uint256 tokenId, bytes memory data internal virtual mintto, tokenId; require checkOnERC721Receivedaddress0, to, tokenId, data, "ERC721: transfer to non ERC721Receive...

Liquidation can be escaped by depositing a WJLP with _rewardOwner != _borrower

Handle WatchPug Vulnerability details updateWAssetsRewardOwnercollsToUpdate, borrower, yetiFinanceTreasury; In liquidateNormalMode, WAsset rewards for collToRedistribute will accrue to Yeti Finance Treasury, However, if a borrower wrap WJLP and set rewardOwner to other address,...

Wrong returns of SavingsAccountUtil.depositFromSavingsAccount() can cause fund loss

Handle WatchPug Vulnerability details The function SavingsAccountUtil.depositFromSavingsAccount is expected to return the number of equivalent shares for given asset. / @notice internal function used to get amount of collateral deposited to the pool @param fromSavingsAccount if true, collateral i...

DoS when depositing collateral

Handle cmichel Vulnerability details The Pool.depositCollateral and Pool.addCollateralInMarginCall functions require the caller to have a pool token balance of zero. function depositCollateraluint256 amount, bool transferFromSavingsAccount external payable override requireamount != 0, 'DC1'; //...

AaveVault does not update TVL on deposit/withdraw

Handle cmichel Vulnerability details Aave uses rebasing tokens which means the token balance aToken.balanceOfthis increases over time with the accrued interest. The AaveVault.tvl uses a cached value that needs to be updated using a updateTvls call. This call is not done when depositing tokens whi...

Tokens can be stolen when depositToken == rewardToken

Handle cmichel Vulnerability details The Streaming contract allows the deposit and reward tokens to be the same token. I believe this is intended, think Sushi reward on Sushi as is the case with xSushi. The reward and deposit balances are also correctly tracked independently in depositTokenAmount...

Storage variable unstreamed can be artificially inflated

Handle harleythedog Vulnerability details Impact The storage variable unstreamed keeps track of the global amount of deposit token in the contract that have not been streamed yet. This variable is a public variable, and users that read this variable likely want to use its value to determine wheth...

IbbtcVaultZap.sol#deposit() can be front run

Handle WatchPug Vulnerability details function deposituint2564 calldata amounts public whenNotPaused // ... Given that IbbtcVaultZap.soldeposit will add liquidity to the curve pool, and the amount out differs when the price of tokens in the pool changes. However, the current implementation provid...

No slippage control on deposit of IbbtcVaultZap.sol

Handle gzeon Vulnerability details Impact There is no slippage control on deposit of IbbtcVaultZap.sol, which expose user to sandwich attack. Proof of Concept Any deposit can be sandwiched, especially when the pool is not balanced. Tools Used Recommended Mitigation Steps Add a minOut in line with...

Users Can Reset Bond Depositor's Vesting Period

Handle leastwood Vulnerability details Impact The VaderBond.deposit function overwrites a depositors bond info on each call with the updated payout information. If any of the vesting is left unclaimed before a call to deposit is made, the vesting period is reset to terms.vestingTerm, resulting in...

A malicious user can potentially escape liquidation by creating a dust amount position and trigger the liquidation by themself

Handle WatchPug Vulnerability details In the current implementation, a liquidated position can be used for depositing and borrowing again. However, if there is a liquidation auction ongoing, even if the position is now liquidatable, the call of triggerLiquidation will still fail. The liquidator...