Looking for student debt relief? Watch out for scammers says the FBI

The FBI believes that scammers may be after people applying for the One-Time Federal Student Loan Debt Relief, a program announced by the Biden-Harris Administration in August 2022 that provides up to $20,000 in student loan debt relief. In a recent public service announcement, the agency warned ...

Lack Of A Safety Mechanism For Deducting Selling Fees

Lines of code Vulnerability details Vulnerability Details The transferFees function of the BlurExchange contract calculates and transfers selling fees to multiple fee receivers as shown in L477 - 478 in code snippet 1. The selling fees would be deducted from the selling price. In other words, a...

The seller could stoln the Creator Royalties

Lines of code Vulnerability details Impact the seller could set their address to get the Creator Royalties Proof of Concept execute == executeFundsTransfer == transferFees for uint8 i = 0; i fees.length; i++ uint256 fee = price feesi.rate / INVERSEBASISPOINT; transferTopaymentToken, from,...

Buyer can receive chargeback from fees.

Lines of code Vulnerability details Impact Since there is no check on who the fees.recipient is in the sell order, the buyer could be the fees recipient, with some additional signature malleability to pass the signature validation, the buyer would receive fees, thus pay less for the NFT. Proof of...

Multiplication performed after division can truncate the results

Lines of code Vulnerability details Multiplication performed after division can truncate the results Impact Solidity could truncate the results, performing multiplication before division will prevent rounding/truncation in solidity math. Details This can affect variables such as slopes, interests...

Using large liquidation fees to steal funds

Lines of code Vulnerability details The liquidation fees can be higher than the liquidation buffer i.e., cleanLiquidationFee LTVPRECISION - maxLTV. Lenders are not fully repaid during liquidation when this is true. In a malicious scenario, an attacker may deploy a pool with very large liquidation...

MarketFees's treasury can have potentially a malicious admin

Lines of code Vulnerability details Impact / Proof of Concept In contracts/FoundationTreasury.sol, an attacker can frontrun a call to initialize to register as an admin. If the address of this treasury is shared or is already shared with NFTDropMarket's constructor line 83, then on line 87,...

vaultOwner Can Front-Run rebalance() With setAutomation() To Lower Incentives

Lines of code Vulnerability details Impact A vaultOwner who is "not confident enough in ourselves to stay up-to-date with market conditions to know when we should move to less volatile collateral to avoid liquidations." They can open their vault to other users who pay attention to the markets and...

Fees are lost after GOLOM token supply limit has been reached

Lines of code Vulnerability details Impact When the 1 billion supply has been reached for the GOLOM token, addFee in RewardDistributor will automatically return to the start without updating any trades, however will still accept fees being sent from GolomTrader. These fees however cannot be claim...

PUT short option is always in loss

Lines of code Vulnerability details Impact For a long PUT condition the party which is doing short will always be in loss Proof of Concept 1. Alice creates and signs a long put option order off-chain for 2 Bored Ape floors with a duration of 30 days, a strike of 124 WETH and a premium of 0.8 WETH...

onERC721Received() could delegatecall to transder the tokens

Lines of code Vulnerability details onERC721Received could delegatecall to transder the tokens Impact Some onERC721Received could use delegatecall to drain the tokens Putty holds. Because the msg.sender is Putty contract, the tarnsfer can go through. Or taking the ownership of the Putty contract...

fee proportional to strike even for unexercised orders

Lines of code Vulnerability details Impact The protocol takes a fee proportional to the order's strike. This happens during a withdraw: // transfer strike to owner if put is expired or call is exercised if order.isCall && isExercised || !order.isCall && !isExercised // send the fee to the admin/D...

[H-02] Owner does not get any fee when call is expired

Lines of code Vulnerability details Owner\creators lose profit by not collecting the fees on half the expired cases all calls. The only place where owner receives fee is when withdrawing an exercised call or expired put: But when a call expired, no fee has been collected on any part of the order...

[H-04] Some fees are locked on contract without ever being able to be collected

Lines of code Vulnerability details Proof of Concept The full amount a is transferFrom lender on L215 The amount - fee is invested on L219 and L229. Unlike other lend function, this one is missing crediting the project with the fees they entitled to. As a result, these fees cannot be collected vi...

Yield of LiquidityReserve can be stolen

Lines of code Vulnerability details Impact Using sandwich attacks and JIT Just-in-time liquidity, the yield of LiquidityReserve could be extracted for liquidity providers. Proof of Concept The yield of LiquidityReserve is distributed when a user calls instantUnstakeReserve in Staking. Then, in...

Fees should be paid by the user when lend() to Swivel

Lines of code Vulnerability details function lend uint8 p, address u, uint256 m, uint256 memory a, address y, Swivel.Order calldata o, Swivel.Components calldata s public unpausedp returns uint256 // lent represents the number of underlying tokens lent uint256 lent; // returned represents the...

instantUnstake function can be frontrunned with fee increase

Lines of code Vulnerability details Impact instantUnstake allows user to unstake their stakingToken for a fee paid to the liquidity providers. This fee could be changed up to 100% any moment by admin. Malicious admin could frontrun users instantUnstake transaction and set fee to any value using...

attacker can give a smaller amount of tokens and not pay the fees

Lines of code Vulnerability details Impact an attacker can specify an amount like from 1 wei or more but depends on the state of the contract variables. amount= 1 adminfee=5 / 1000000 = 0 because of persion loss whichfeeAdmin=0 same thing for the other fees and there is no check that they cant be...

InfinityExchange owner can grief with high fees

Lines of code Vulnerability details Impact The owner of the InfinityExchange contract can set any high fee values for PROTOCOLFEEBPS via the InfinityExchange.setProtocolFee function. The fee value should be limited to a maximum of 10000. If set to higher values and due to the usage across functio...

The owner can set arbitrarly high fees

Lines of code Vulnerability details Impact The owner of InfinityExchange contract can set arbitrarly big fees, and coul stole funds from seller. Proof of Concept When an order is executed the payment and the transfer from buyer to seller and viceversa are done by transferNFTsAndFees function wich...