Host can bypass reentrancy guard in rageQuit()

Lines of code Vulnerability details Impact Host can bypass reentrancy guard in rageQuit. Proof of Concept In PartyGovernanceNFT.rageQuit there is a reentrancy guard: // Check if ragequit is allowed. uint40 currentRageQuitTimestamp = rageQuitTimestamp; if currentRageQuitTimestamp !=...

Delegate should check that terminal is operating with ETH as the terminal token

Lines of code Vulnerability details Delegate should check that terminal is operating with ETH as the terminal token The JBXBuybackDelegate implementation is only prepared to operate with ETH as the terminal token. The implementation should check that the JuiceBox terminal matches this case. Impac...

Zero token transfer can cause a potential DoS in CVXStaker

Lines of code Vulnerability details Zero token transfer can cause a potential DoS in CVXStaker The CVXStaker contract doesn't check for zero amount while transferring rewards, which can end up blocking the operation. Impact The CVXStaker contract is in charge of handling interaction with the Conv...

_transferAjnaRewards doesn't save the remaining rewards of a staker for the next transfer

Lines of code Vulnerability details Impact Staker will earn less than expected Proof of Concept On claimRewards function at transferAjnaRewards is being called to claim rewardsEarned for staker according to the tokenId, the issue here drop at if rewardsEarned ajnaBalance rewardsEarned =...

Upgraded Q -> 2 from #878 [1683053139232]

Judge has assessed an item in Issue 878 as 2 risk. The relevant finding follows: L-8 Zero amount ERC20 token transfers may fail some implementations - --- The text was updated successfully, but these errors were encountered: All reactions...

[H-06] Double-entrypoint collateral token allows position owner to withdraw underlying collateral without repaying ZCHF

Lines of code Vulnerability details Impact Position::withdraw is intended to allow the position owner to withdraw any ERC20 token which might have ended up at position address. If the collateral address is passed as argument then Position::withdrawCollateral is called to perform the necessary...

can launch a challenge without any collateral in MintingHub.sol

Lines of code Vulnerability details Impact launchChallenge... function in MintingHub.sol ignores return value by challenge.position.collateral.transferFrom Several tokens do not revert in case of failure and return false. If the token used as collateral return false, the user can launch a challen...

can open a position without any collateral in MintingHub.sol

Lines of code Vulnerability details Impact openPosition... function in MintingHub.sol ignores return value by challenge.position.collateral.transferFrom Several tokens do not revert in case of failure and return false. The require still pass but then, if the token used as collateral return false,...

Return values of ERC20 transfer and transferFrom are unchecked

Lines of code https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/StablecoinBridge...

Allowance not updated correctly

Lines of code Vulnerability details Impact allowance doesn't get updated properly therefore an attacker contract can exploit the token contract by transferring some tokens and still spend the same amount of allowance. Here are the steps: calling approve function from ERC20.sol with the spender...

No router for PrivatePools with ERC20 base token

Lines of code Vulnerability details Impact There is no implementation of a router for PrivatePools with an ERC20 base token in the repository. PrivatePool is implemented without protection against slippage, which is assumed to be the responsibility of the router. Such a router exists for pools wi...

Upgradeability completely breaks decentralization

Lines of code Vulnerability details Impact Owner of SafEth can steal all staked funds. Proof of Concept SafEth is an upgradeable ERC20 contract that handles the conversion between ETH and whatever derivatives that are implemented. But it also has access to the staked funds through the derivatives...

Disabling self-transfer may cause integration issues with other protocols

Lines of code Vulnerability details Impact Integration errors with other protocols Proof of Concept The changes made for H-01 causes transfers to revert if from == to. This is problematic because this is non-standard ERC20 behavior that can cause integration risk/issues with other protocols. I...

ZERO TRUNCATION COULD LEAD TO UNEXPECTED RESULTS

Lines of code Vulnerability details Impact Precision issue leading to zero truncation due to numerator smaller than denominator in a ratio or a division happens readily in Solidity if extra cares have not been given to it. Arithmetic operations running into this incident are typically associated...

Incorrect validation of the result of the transfer * transferFrom method call. Failure to comply with the ERC20 standard

Lines of code Vulnerability details Impact Inability to use ERC20 standard tokens. As an example of the future LP token Proof of Concept According to the ERC-20 standard, the transfer and transferFrom methods return true or false, but looking at the code we see that:...

Current transfer implementations can lead to loss of user founds if LP is updated or wrongly set

Lines of code Vulnerability details Current transfer implementations can lead to loss of user founds if LP is updated or wrongly set The current implementation of assetTransfer and assetTransferFrom don't check if the asset is a contract and don't check if the transfer returns a false instead of...

Incorrect usage of safeTransferFrom() function . This permanently traps ticketPrice in sender address (msg.sender )

Lines of code Vulnerability details Impact Because the callermsg.sender never gives approval for ERC20 transfers, calls to safeTransferFrom on the contract will revert with insufficient approval. This will trap from caller and unable to transfer ticketPrice to Lottery contract address. The root...

Incorect handling of decimals

Lines of code Vulnerability details Impact Incorect calculations in case token will have a different number of decimals Proof of Concept Both the earned and the rewardPerToken functions are calculation the decimals based on the hardcoded assumption that the token will have 1e18 decimals, however...

Rewards for the Staking.sol contract may be stolen via the first staker

Lines of code Vulnerability details Impact The return amount of the function rewardPerToken may be inflated for the first in the Staking.sol contract. Proof of Concept The Staking.sol contract is designed for the LOT token holders to be able to stake their native tokens. Thus, the token holders...

In the beginning its relatively easy to gain majority share

Lines of code Vulnerability details Impact As mentioned in the document, Although possible, the permissions to execute arbitrary actions or upgrade the DAO should not be given to EOAs as this poses a security risk to the organization if the account is compromised or acts adversarial. Instead, the...