Tokens are directly transferred from briber to BribeVault

Lines of code Vulnerability details Impact Function depositBribeERC20 in BribeVault transfers tokens directly from the briber: // Since this method is called by a depositor contract, we must transfer from the account // that called the depositor contract - amount must be approved beforehand...

Reentrancy in depositBribeERC20 function

Lines of code Vulnerability details Impact depositBribeERC20 function in BriveVault is reentrant in line 187, where an address supplied by the caller is called. A bad actor that has DEPOSITORROLE and is a contract can execute a folowing attack: 1. Create a dummy token contract, reentrant in the...

[WP-H0] DEFAULT_ADMIN_ROLE of BribeVault can steal tokens from users' wallets

Lines of code Vulnerability details The current design/implementation allows the DEFAULTADMINROLE of BribeVault to steal funds from any address that approved this contract up to allowance: As a DEFAULTADMINROLE, the attack is simply do the following steps: 1. grantDepositorRole to self; 2...

Reentrancy in depositBribeERC20

Lines of code Vulnerability details Description The contract was found vulnerable to Reentrancy attack. It was noticed that the function depositBribeERC20 makes an external call to another untrusted address or a contract before it resolves any effects at line "" If the attacker controls the...