Potential DoS when closing a credit nominated in ETH in the LineOfCredit contract

Lines of code Vulnerability details When closing a credit that was issued in ETH, the LineOfCredit contract will send the lender his deposit and any accrued interests using the address.transferamount function, which may fail and revert the whole function, leading to an eventual DoS. Impact The...

LineLib.receiveTokenOrETH() can accept more ETH than it accounts for

Lines of code Vulnerability details Impact LineLib.receiveTokenOrETH can receive ETH and accounts for an amount to receive but it is possible to send more ETH than amount, meaning that any extra ETH sent will be lost to the contract. Proof of Concept LineLib.receiveTokenOrETH is as follows...

Arbitrary call order to handle mutual consent can lead to unrecoverable native ETH

Lines of code Vulnerability details Creating new credits and increasing the credit deposit requires both parties, the lender and the borrower, to agree. This is implemented by having both call the same function with the same call data. However, as it's possible to use native ETH as a credit token...

Functions addCredit(...) and increaseCredit(...) can lock lender’s ETH forever

Lines of code Vulnerability details Impact In LineOfCredit contract, both functions addCredit... and increaseCredit... require mutual consent between lender and borrower. If lender is tricked by borrower, or by mistake, lender ETH will be locked in the contract forever. function addCredit uint128...

RDMA stack bug fix and enhancement update

An update is available for ucx, rdma-core, mstflint, libvma, fabtests, eth-tools, libfabric. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed...

MED: Some royalty ETH will be stuck in the Holographer contract forever.

Lines of code Vulnerability details Description PA1D.sol's payoutEth function is responsible for distributing ETH holdings in the Holographer. It uses this code: uint256 gasCost = 23300 length + length; uint256 balance = addressthis.balance; requirebalance - gasCost 10000, "PA1D: Not enough ETH t...

_payoutEth() calculates balance with an offset, always leaving dust ETH in the contract

Lines of code Vulnerability details Payout recipients can call getEthPayout to transfer the ETH balance of the contract to all payout recipients. This function makes an internal call to payoutEth, which sends the payment to the recipients based on their associated bp The issue is that the balance...

Beneficiary loses credit when specifying payment with flag _dontMint = true

Lines of code Vulnerability details Impact In the function processPayment, it will use provided JBDidPayData to mint to the beneficiary. The payment can specify some flags to help guiding how balance will be used to mint. There is a flag dontMint indicating if the transaction should not mint...

If L1GraphTokenGateway's outboundTransfer is called by a contract, the entire msg.value is blackholed, whether the ticket got redeemed or not.

Lines of code Vulnerability details The outboundTransfer function in L1GraphTokenGateway is used to transfer user's Graph tokens to L2. To do that it eventually calls the standard Arbitrum Inbox's createRetryableTicket. The issue is that it passes caller's address in the submissionRefundAddress a...

User can send an excess of ETH to L1GraphTokenGateway

Lines of code Vulnerability details Impact User can send too much ether into the contract which may get stuck if there is issues with the refund process. Proof of Concept User sends too much ether to outboundTransfer. This is sent to a refund address in Arbitrum. If Arbitrum is compromised or suc...

Possible loss of assets for seller through cross-contract re-entrancy

Lines of code Vulnerability details Impact BlurExchange.execute applies a reentrancyGuard modifier, however does not apply the Check-Effect-Interact pattern since cancelledOrFilledsellHash and cancelledOrFilledbuyHash are set to true after the transfers. This presents the risk of a cross-contract...

The Frax ETH liquid staking protocol WRONGLY assumes that the users can convert their sfrxETH for more frxETH over time

Lines of code Vulnerability details Impact The Frax ETH liquid staking protocol WRONGLY assumes that the users can convert their sfrxETH for more frxETH over time.But because of any untoward incident if the validators stake can gets slashed, then this assumption will be wrong and can cause severe...

TIMELOCK_ROLE Can Withdraw FUND from the Contracts via recoverEther()

Lines of code Vulnerability details Impact The Timelock Address role is misidentified in this agreement and has high authority. While I believe developer have good intention to use these functions. It often associate with Rug Pull by developer in the eyes of investors because Rug Pull is not...

[H1] Owner of frxETHMinter can rug pull the contract

Lines of code Vulnerability details Impact Owner of the contract is able to leave with all the tokens and ETH of the contract, which makes protocol trustless PoC You have implemented a function to function recoverEtheruint256 amount external onlyByOwnGov bool success, = addressowner.call value:...

Use of transfer() instead of call() to send eth

Lines of code Vulnerability details Use of transfer instead of call to send eth Impact Use of transfer might render ETH impossible to withdraw because after istanbul hardfork, there is increases in the gas cost of the SLOAD operation and therefore breaks some existing smart contracts.Those...

The user Can't swap their frxETH to ETH

Lines of code Vulnerability details Impact I’m so confused I didn't find any logic to withdrawing my funds ETH by transferring my frxETH Recommended Mitigation Steps Create logic for withdrawals swap --- The text was updated successfully, but these errors were encountered: All reactions...

High privilege of setWithholdRatio function

Lines of code Vulnerability details Impact With the setWithholdRatio function, most of the funds can be authorized to be confiscated, such authority is too high and can confuse users, If this authority is to be used for commission deduction, it should be clearly stated. Proof of Concept /// @noti...

Risk of ETH funds Rug Pull in the moveWithheldETH and recoverEther functions

Lines of code Vulnerability details Impact In the frxETHMinter contract both the owner and governance timelock have the power to call the functions moveWithheldETH and recoverEther, those functions allow the transfer of the ETH from frxETHMinter to the owner or a given account, this means that th...

Admin rug vector in moveWithheldETH()

Lines of code Vulnerability details According to the documentation, currentWithheldETH is meant to: withhold part of the ETH deposit for future use, such as to earn yield in other places to supplement the ETH 2.0 staking yield The issue is that the owner can call moveWithheldETH with an arbitrary...

Some users won't be able to burn their crowdfund token to get their voting power

Lines of code Vulnerability details Impact User which is a contract who doesn't have a receive function can't burn his token to get the governance power, because ethOwed ether are transferred to him. This is correct even if ethOwed is 0. Tools Used Manual audit Recommended Mitigation Steps Consid...