Delegate doesn't verify payed ETH value matches amount in parameter

Lines of code Vulnerability details Delegate doesn't verify payed ETH value matches amount in parameter The JBXBuybackDelegate delegate fails to check that the sent ETH amount matches the value passed in the amount parameter. Impact The payable didPay function present in the delegate is called by...

Should check for _data.amount.value

Lines of code Vulnerability details Impact msg.value is not checked in didPay, if swap is not successful, the eth amount sent back to the terminal is data.amount.value, which is provided by the user. If there is leftover eth in the contract, the fund could be stolen. Proof of Concept Some eth cou...

mintedAmount and reservedRate mutex not working

Lines of code Vulnerability details Impact File: JBXBuybackDelegate.sol 101 / 102 @notice The amount of token created if minted is prefered 103 104 @dev This is a mutex 1-x-1 105 / 106 uint256 private mintedAmount = 1; 107 108 / 109 @notice The current reserved rate 110 111 @dev This is a mutex...

Attacker can front-run didPay() by calling payParams() to set mintedAmount & reservedRate, reducing output amount

Lines of code Vulnerability details Impact Attacker can front-run didPay by calling payParams to set mintedAmount & reservedRate. This will reduce the output amount the caller to didPay was expecting to receive. Proof of Concept Anyone can call payParams and provide arbitrary input to set...