Reentrancy attack on fee transferring

Lines of code Vulnerability details Vulnerability details Description There is execute function in the Exchange smart contract. The function matches two orders, ensuring the validity of the match, transfers the order fees, etc. When transferring fees, the contract just makes a call to the...

Upgraded Q -> M from #474 [1668467584757]

Judge has assessed an item in Issue 474 as M risk. The relevant finding follows: L-01 Flashloan fee is not validated flashLoanFee is determined at LBFactory's constructor as; constructoraddress feeRecipient, uint256 flashLoanFee setFeeRecipientfeeRecipient; flashLoanFee = flashLoanFee; emit...

LooksRareProxy is missing the fee mechanism, protocol may loss the revenue from fee

Lines of code Vulnerability details Impact LooksRareProxy is missing the fee mechanism, the protocol may lose revenue from the fee. Even if you intend to have a free fee, the fee mechanism should be implemented in case you need to enforce the fee in the future. Proof of Concept function execute...

Logic in LineLib does not work correctly with fee-on-transfer tokens

Lines of code Vulnerability details Proof of Concept Some tokens take a transfer fee e.g. STA, PAXG, some do not currently charge a fee but may do so in the future e.g. USDT, USDC. The code currently receives ERC20 tokens but does not account for the potential fees paid in the transfer. If such a...

Not checking amount of received ERC20 tokens

Lines of code Vulnerability details Description There are ERC20 tokens, which apply intenal fee on transfers such as USDT, so that amount of received tokens could differ from requested amount. There is a line where contract receives facilityFee as an amount of tokens. The same variable is used on...

Any use of fee-on-transfer tokens as quote tokens in auctions will result in freeze or loss of funds for users.

Lines of code Vulnerability details Description SIZE auctions do not support fee-on-transfer tokens. The platform rejects taxed baseToken during createAuction: // Passes https://github.com/transmissions11/solmate/blob/main/src/utils/SafeTransferLib.solL9 // Transfer base tokens to auction contrac...

quoteToken could be fee-on-transfer token

Lines of code Vulnerability details Impact Some ERC20 tokens could have fees for each transfer, they are known as "fee-on-transfer" tokens. While there is a check inside createAuction function that prevents these tokens from being baseToken, FoT tokens still allowed to be quoteToken which could...

CVE-2022-43078

A cross-site scripting XSS vulnerability in /admin/add-fee.php of Web-Based Student Clearance System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter...

CVE-2022-43079

A cross-site scripting XSS vulnerability in /admin/add-fee.php of Train Scheduler App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter...

Web-Based Student Clearance System 跨站脚本漏洞

Web-Based Student Clearance System is a web-based student clearance system by the individual developer Ndueso Okorie. A cross-site scripting vulnerability exists in Web-Based Student Clearance System version v1.0, which originates from a cross-site scripting XSS vulnerability contained in...

Train Scheduler App 跨站脚本漏洞

Train Scheduler App is a train scheduling application by Carlo Montero Personal Developer. A security vulnerability exists in Train Scheduler App v1.0, which stems from a cross-site scripting XSS vulnerability contained in /admin/add-fee. An attacker can exploit this vulnerability to execute...

If user sets a low gasPrice the operator would have to choose between being locked out of the pod or executing the job anyway

Lines of code Vulnerability details During the beaming process the user compensates the operator for the gas he has to pay by sending some source-chain-native-tokens via hToken. The amount he has to pay is determined according to the gasPrice set by the user, which is supposed to be the maximum g...

Users can create beam request for a destination chain without paying a fee.

Lines of code Vulnerability details Impact When a user creates a beam request for a destination chain, the user can input zero as a value for gasLimit. With this, the user is able to make the request without paying any fees to Hologram since messagingModule.getHlgFeetoChain, gasLimit, gasPrice;...

Volatility update bypassed with small transactions

Lines of code Vulnerability details Impact Volatility, and by extension the fee rate increase due to volatility can be circumvented by starting swaps with a token amount. The volatility is accumulated only at specific intervals, similar to the cumulative number of bins crossed. This is an issue...

Attacker can steal entire reserves by abusing fee calculation

Lines of code Vulnerability details Description Similar to other LP pools, In Trader Joe users can call mint to provide liquidity and receive LP tokens, and burn to return their LP tokens in exchange for underlying assets. Users collect fees using collectFessaccount,binID. Fees are implemented...

When admin sets fee parameters on a pair, it is guaranteed to corrupt the critical static fee parameters.

Lines of code Vulnerability details Description Factory owner can configure fee parameters of any pair using setFeesParametersOnPair. The actual change in pair storage happens in setFeeParameters: function setFeesParametersbytes32 packedFeeParameters internal bytes32 feeStorageSlot; assembly...

Wrong implementation of function LBPair.setFeeParameter can break the funcionality of LBPair and make user's tokens locked

Lines of code Vulnerability details Vulnerable detail Struct FeeParameters contains 12 fields as follows: struct FeeParameters // 144 lowest bits in slot uint16 binStep; uint16 baseFactor; uint16 filterPeriod; uint16 decayPeriod; uint16 reductionFactor; uint24 variableFeeControl; uint16...

Swaps could be blocked temporarily

Lines of code Vulnerability details Impact In the swap and swapSupportingFeeOnInputTokens functions the community fee payment is called by the function payCommunityFee. The payCommunityFee will fail if the vault address is 0x0 and all the swap will be reverted by the safeTransfer. The...

Incorrect volatility on range calculation

Lines of code Vulnerability details Impact Incorrect calculation of volatility impairs the adaptive swap fee calculation. Actual swap fees may be bigger or smaller than expected. Proof of Concept According to the Tech Paper, volatility during the period $\Delta t$ is calculated as follows:...

Minting LP for a token pair that contains a fee on transfer token will cause partial loss of funds for other token in pair

Lines of code Vulnerability details Impact Partial loss of funds for other token in pair with fee on transfer token Proof of Concept AlgebraPool.solL458-L467 liquidityActual = liquidityDesired; if receivedAmount0 amount0 liquidityActual = uint128FullMath.mulDivuint256liquidityActual,...