The validateCreateOrderHash function is vulnerable to an incorrect token type being provided by the caller

Lines of code Vulnerability details Impact Invalid token types could be used with encoded order info, breaking expectations of the contract. An attacker could create an order hash using different parameters than what is actually encoded in the orderInfo. This could potentially allow the attacker ...

Fee on Transfer tokens cause incorrect accounting

Lines of code Vulnerability details Impact Incorrect accounting for fee on transfer tokens Proof of Concept Delegate accepts all ERC20 token types as specified by the contest page. Some ERC20 tokens include a fee on transfer which means means that the amount of tokens sent to the contract will be...

Fee on transfer tokens will cause users to lose funds

Lines of code Vulnerability details Impact Some ERC20 tokens allow for charging a fee any time transfer or transferFrom is called. If a contract does not allow for amounts to change after transfers, subsequent transfer operations based on the original amount will revert due to the contract having...

In DestinationBridge:rescueTokens function the owner can steal user tokens

Lines of code Vulnerability details Summary In the rescueToken function, it opens the door to potential insecurity for user funds because it lacks additional conditions specifying which types of tokens or under what conditions the onlyOwner can use this function. The function looks like: / @notic...

Low level calls to accounts with no code will succeed in multiexcall function

Lines of code Vulnerability details Impact Low level calls behave differently than function calls in Solidity. Calls at the EVM level to accounts with no code are successful, this is the expected and normal behavior. It is Solidity that adds checks to prevent accidental calls to accounts with no...

PerpetualAtlanticVaultLP incentives can be stolen via flash loan

Lines of code Vulnerability details Impact The liquidity pooled from the PerpetualAtlanticVaultLP is used by the core contract. This liquidity is provided by anyone, and after each epoch 1 week an incentive is paid after to further incentivise liquidity provision. However, the funds can be stolen...

Potential Over-redemption Vulnerability in redeem Function

Lines of code Vulnerability details Impact In the redeem function, when a third party is using their allowance to redeem shares on behalf of an owner, there exists a potential scenario where the third party could redeem more than originally intended by the owner. Proof of Concept This is how the...

Options could not be settled, causing liquidity get locked in vault

Lines of code Vulnerability details Impact In settle logics, RdpxV2Core contract calls to PerpetualAtlanticVault.settle to update funding, burn option tokens and do some token settles. However, the logic could be reverted in the call...

Functions Not Considering ERC20 Transaction Fees

Lines of code Vulnerability details Impact Some ERC20 tokens charge a transaction fee for every transfer used to encourage staking, add to liquidity pool, pay a fee to contract owner, etc.. Sometimes this is not a problem but in the cases where the same value is passed to a state variable and to...

CTokenV3Collateral._underlyingRefPerTok should use the decimals from underlying Comet.

Lines of code Vulnerability details Impact CTokenV3Collateral.underlyingRefPerTok uses erc20Decimals which is the decimals of CusdcV3Wrapper. But it should use the decimals of the underlying Comet. Proof of Concept CTokenV3Collateral.underlyingRefPerTokcomputes the actual quantity of whole...

Race condition in approve function can lead to more funds than intended being transferred

Lines of code Vulnerability details Impact The approve function from MToken.sol contains a front-running vulnerability that allows a user to spend more tokens than he should. Proof of Concept Lets take the following scenario: 1. Alice calls approveEve, 10. This permits Eve to spend 10 tokens from...

## [M-07] ERC20 return values not checked

Lines of code Vulnerability details Impact Tokens that don’t actually perform the transfer and return false are still counted as a correct transfer and the tokens remain in the SingleNativeTokenExitV2 contract and could potentially be stolen by someone else. Proof of Concept The ERC20.transfer an...

Unchecked Call Return Value of ERC20 Functions

Lines of code Vulnerability details Impact The return value of 'transfer' and 'transferFrom' should be verified since these two functions may only return false but not cause execution reverted once fail. If not properly handled, it might incur asset losses to users and the project party. Tools Us...

Arbitrary from in transferFrom

Lines of code Vulnerability details Impact function aaddress from, address to, uint256 amount public erc20.transferFromfrom, to, am; Alice approves this contract to spend her ERC20 tokens. Bob can call a and specify Alice's address as the from parameter in transferFrom, allowing him to transfer...

GSC will lose allowance if it tries to lower a spender's approval

Lines of code Vulnerability details Impact GSC will lose allowance if it tries to lower a spender's approval. Proof of Concept When gsc update a spender's approval, the gscAllowance will always decrease by amount: function gscApprove address token, address spender, uint256 amount external...

ARCDVestingVault.sol::revokeGrant can revert for zero value transfers with weird ERC20 tokens.

Lines of code Vulnerability details Impact The call to revokeGrant by a Manager before the cliff time has been reached can cause the call to revert for some ERC20 tokens, this can stop the manager from revoking a grant from a given recipient. Proof of Concept The following scenario could occur,...

[H] Users can lose their funds if the transaction reverts on destination chain

Lines of code Vulnerability details Impact The transmitSendToken function in the contract facilitates cross-chain token transfers. For contracts involving ERC20 tokens it is also expected that, should a contract call fail, one's tokens are not lost/transferred elsewhere. However, the function doe...

balanceOf method can be manipulate to liquidated vault

Lines of code Vulnerability details Impact Deriving price from balanceOf can be manipulated to liquidate vault see example Attacker can provide ERC20 token to the vaultAsset and mint vault shares. The deposited tokens will then be withdrawn with having same shares in the vault. The shares then wi...

Permit does not revert for tokens that do not implement it.

Lines of code Vulnerability details Impact Callers should not rely on permit to revert for arbitrary tokens especially if permit is used as a security check. Tokens which do not revert on permit either do not implement it or have a non-reverting fallback function. Most notable among them is WETH...

Attacker can drain the forked DAO's ERC20s by supplying a list with dupes to quit()

Lines of code Vulnerability details The quit function is used to allow members of the forked DAO to ragequit the dao and receive a pro-rata share of the ERC20 tokens that the DAO holds. One version of this functions allows the user to supply their own list of ERC20 tokens for the function to...