merge() can cause lock to fail due to tokenId collision

Handle WatchPug Vulnerability details function generateNewTokenIduint256 points internal view returns uint256 tokenId // Points is capped at 128 bits max supply of XDEFI for 10 years locked, total supply of NFTs is capped at 128 bits. return points PoC 1. Alice lock 1 XDEFI for 7 days 3 times got...

NFT is not burned during unlock

Handle sirhashalot Vulnerability details Impact When the lock function is called, an ERC721 token is minted. The unlock function should perform the opposite operation as lock and burn the corresponding NFT. The unlock function modifies the positionOf mapping, but does NOT call the burn function t...

_generateNewTokenId can create collisions

Handle sirhashalot Vulnerability details Impact The ERC721 standard requires that "for any ERC-721 Contract, the pair contract address, uint256 tokenId must be globally unique" quoted from . However, the generateNewTokenId function can produce tokenId values that are not globally unique. This wou...

Reentrancy allows attacker to lock the funds deposited in the contract

Handle tqts Vulnerability details Impact It is possible for attackers to exploit a reentrancy issue in lockuint256,uint256,address that would allow them to lock all funds deposited prior to the attack. Proof of Concept The problem lies in the lockuint256,uint256,address function, that transfers t...

Missing burn function in _unlock function

Handle Tomio Vulnerability details Impact In the XDEFIDistribution.sol, a user can lock xdefi token and get an erc721/nft token through safeMint function, however when the user call unlock function this contract will delete the position of this user, but didnt call the burn function in ERC721...

no reentrancy guard on mint() function that has a callback

Handle jayjonah8 Vulnerability details Impact In CollateralizedDebt.sol, the mint function calls safeMint which has a callback to the "to" address argument. Functions with callbacks should have reentrancy guards in place for protection against possible malicious actors both from inside and outsid...

NFTXMarketplaceZap.sol#buyAnd***() should return unused weth/eth back to msg.sender instead of to

Handle WatchPug Vulnerability details function buyAndSwap721WETH uint256 vaultId, uint256 memory idsIn, uint256 memory specificIds, uint256 maxWethIn, address calldata path, address to public nonReentrant requireto != address0; requireidsIn.length != 0;...

NFTXStakingZap and NFTXMarketplaceZap's transferFromERC721 transfer Cryptokitties to the wrong address

Handle hyh Vulnerability details Impact transferFromERC721address assetAddr, uint256 tokenId, address to should transfer from msg.sender to to. It transfers to addressthis instead when ERC721 is Cryptokitties. As there is no additional logic for this case it seems to be a mistake that leads to...

Attacker can break addLiquidity721() by transferring vaultToken to the contract

Handle WatchPug Vulnerability details function addLiquidity721WETH uint256 vaultId, uint256 memory ids, uint256 minWethIn, uint256 wethIn, address to internal returns uint256, uint256, uint256 address vault = nftxFactory.vaultvaultId; requirevault != address0, "NFTXZap: Vault does not exist"; //...

NFTXMarketplaceZap Performs A Dangerous Equality Check Which Can Brick Contract

Handle leastwood Vulnerability details Impact NFTXMarketplaceZap provides an interface for users to interact with NFTX vaults by buying, selling and swapping ERC1155/ERC721 tokens. The mint721 and mint1155 functions perform strict equality checks on the vaults token balance for the...

0x-hunter-core (>=1.0.0-33, <=1.0.0-38), 1155-to-20 (>=1.0.0, <=1.0.2) +2816 more potentially affected by CVE-2021-46320 +1 more via @openzeppelin/contracts (>=3.2.0, <=4.4.0)

@openzeppelin/contracts NPM version =3.2.0, =1.0.0-33, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.9.1, =3.24.7, =1.7.2, =3.10.3, =0.0.2, =1.4.1, =1.0.0, =1.0.0-alpha.0, =1.1.0-alpha.0 and more Source cves: CVE-2021-46320, CVE-2022-39384 Source advisory: OSV:GHSA-9C22-PWXW-P6HX...

PrizePool.awardExternalERC721() Erroneously Emits Events

Handle leastwood Vulnerability details Impact The awardExternalERC721 function uses solidity's try and catch statement to ensure a single tokenId cannot deny function execution. If the try statement fails, an ErrorAwardingExternalERC721 event is emitted with the relevant error, however, the faile...

@biconomy/hyphen-contracts (1.0.4), @devprotocol/protocol-l2 (>=0.0.1, <=0.0.2) +8 more potentially affected by CVE-2021-41264 via @openzeppelin/contracts-upgradeable (>=4.2.0, <=4.3.1)

@openzeppelin/contracts-upgradeable NPM version =4.2.0, =0.0.1, =1.1.2, =1.0.1, =1.1.2, =1.0.0, =0.8.1-pr-brioux-1333.92b26c3a.36, =1.0.5, =2.3.0, =2.3.2 Source cves: CVE-2021-41264 Source advisory: OSV:GHSA-5VP3-V4HC-GX76...

Using transferFrom on ERC721 tokens

Handle shw Vulnerability details Impact In the function awardExternalERC721 of contract PrizePool, when awarding external ERC721 tokens to the winners, the transferFrom keyword is used instead of safeTransferFrom. If any winner is a contract and is not aware of incoming ERC721 tokens, the sent...

Using transferFrom on ERC721 tokens

Handle shw Vulnerability details Editing on a previous submission to correct the details Impact In the function awardExternalERC721 of contract PrizePool, when awarding external ERC721 tokens to the winner, the transferFrom function is called instead of safeTransferFrom. If the winner is a contra...

NFT Hub implementation deviates from ERC721 for transfer functions

Handle 0xRajeev Vulnerability details Impact ERC721 standard and implementation allows the use of approved addresses to affect transfers besides the token owners. However, the L2 NFT Hub implementation deviates from ERC721 by ignoring the presence of any approvers in the overriding function...

RCNftHubL2.safeTransferFrom not accoring to spec

Handle cmichel Vulnerability details Vulnerability Details The RCNftHubL2.safeTransferFrom function does not correctly implement the ERC721 spec: When using safeTransferFrom, the token contract checks to see that the receiver is an IERC721Receiver, which implies that it knows how to handle ERC721...

Missing checkOnERC721Received deviates from ERC721 and could lock/lose NFTs

Handle 0xRajeev Vulnerability details Impact ERC721 specification for safeTransferFrom says: “this function checks if to is a smart contract code size 0. If so, it calls onERC721Received on to and throws if the return value is not bytes4keccak256“onERC721Receivedaddress,address,uint256,bytes”.”...

Unbounded loop in function transferERC721

Handle shw Vulnerability details Impact The function transferERC721 loops over an unbounded array, timelockERC721KeysnftContract, whose length never decreases but increases whenever the owner locks an ERC721 token. Therefore, the required gas for executing this loop grows over time and could reac...

transferERC721 doesn't clean timelockERC721s

Handle gpersoon Vulnerability details Impact The function transferERC721 works similar to the functions timeUnlockERC721 with timelocked NFT's. However timeUnlockERC721 cleans timelockERC721s delete timelockERC721skey;, while transferERC721 doesn't clean timelockERC721s This could mean that...