Admin can set arbitrarily high exchange fees

Lines of code Vulnerability details Impact Admins can attack users by frontrunning them Poc In the function setProtocolFeeInfinityExchange.sol function setProtocolFeeuint16 protocolFeeBps external onlyOwner PROTOCOLFEEBPS = protocolFeeBps;@audit medium emit NewProtocolFeeprotocolFeeBps; Admins ca...

Wrong implementation of rescueETH, causing the fees in native tokens to be frozen in the contract

Lines of code Vulnerability details /// @dev used for rescuing exchange fees paid to the contract in ETH function rescueETHaddress destination external payable onlyOwner bool sent, = destination.callvalue: msg.value''; requiresent, 'failed'; Recommendation Change to: /// @dev used for rescuing...

Accumulated ETH fees of InfinityExchange cannot be retrieved

Lines of code Vulnerability details ETH fees accumulated from takeOrders and takeMultipleOneOrders operations are permanently frozen within the contract as there is only one way designed to retrieve them, a rescueETH function, and it will work as intended, not being able to access ETH balance of...

Timelock has a rug vector bypass

Lines of code Vulnerability details Impact Having a bypass for the timelock defeats the purpose of a timelock. Anyone in the EMERGENCYROLE, or who is able to compromise the key is able to immediately make changes at the expense of users. Proof of Concept executeEmergency can take any action on...

destroy function doesn't check if exitFees is set

Lines of code Vulnerability details Impact This issue might lead to 0 amountFees Proof of Concept The destroy function does not check if exitFees is set, therefore in a scenario wherein the owner does not set the value of exitFees, its default value would be 0. In line 264 we can see: uint256...

Malicious Owner can steal all user funds

Lines of code Vulnerability details Submitting as med risk because it would require malicious multisig, but there should never be absolute trust in any party especially when there's no reason fees would ever need to be that high anyways Impact Owner steals all of user funds Proof of Concept...

Upgraded Q -> H from 25 [1655007954017]

Judge has assessed an item in Issue 25 as High risk. The relevant finding follows: Fees should have a boundary of 100% 10000: Otherwise the contract will try to transfer more than possible which will result in reverts: It might also be helpful the have an fixed upper boundary that doesn't allow t...

Upgraded Q -> H from 110 [1655009286368]

Judge has assessed an item in Issue 110 as High risk. The relevant finding follows: platformFee should be upper bounded to avoid DoS and excessive fees platformFee can take a value of 10000 100% which could be seen as a trust issue: File: RoyaltyVault.sol 67: function setPlatformFeeuint256...

A malicious zone operator can piggyback other transactions, when a caller tries to fulfill the restricted order

Lines of code Vulnerability details If an order has a restricted order type and, if the caller is other than the offerer or zone, then a staticcall to isValidOrder on the zone is made. This call outside the Seaport contract opens up a possible misuse by the zone contract implementation. The zone...

Deposit doesn't initialize WithdrawalMeta

Lines of code Vulnerability details Impact Though LiquidityPool.sol is not in scope, this is related to the PoolMigrationZap.migrate which performs deposits into new pools. The deposit functionality of LiquidityPool.sol does not set the withdrawalMeta for the depositor, meaning that their...

Wrong buy_amt_min calculation in RubiconRouter.swapEntireBalance for multi-hop swaps

Lines of code Vulnerability details Impact The buyamountmin value provided for the swap call is calculating too few fees for multi-hop swaps. Every swap within a multi-hop swap is taking fees. Currently, only a one-time fee is calculated on the basis of the swapEntireBalance function parameter...

Glovo: Exposed valid AWS, Mysql, Sendgrid and other secrets

Summary: Hi team, I just discovered some hardcoded credentials allowing access to AWS, Mysql database, ... To make this report short, here is the POC: see ███ & █████ Steps To Reproduce: where there are the info : APPNAME=Glovo APPENV=local APPKEY=█████ APPDEBUG=false APPURL=http://localhost...

Cally does not support ERC20 tokens with built-in fee

Lines of code Vulnerability details Impact Contract Cally does not properly handle ERC20 tokens that charge fee on their transfers. Implementation of such a tokens does not transfer exact amount provided to transfer but part of it is charged as a fee, burned or used in some other way. This leads ...

sendToCosmos doesn't consider the ERC20 transfer fee, resulting in incorrect amount of ERC20 token

Lines of code Vulnerability details Impact Some ERC tokens have a fee on each transfer. The protocol doesn’t handle the fee when transferring this kind of ERC20 tokens, leading to the inconsistent amount of token actually received in the contract. Validators on the Cudos will mint more tokens to...

Mobile subscription Trojans and their little tricks

Billing fraud is one of the most common sources of income for cybercriminals. There are currently a number of known mobile Trojans specializing in secretly subscribing users to paid services. They usually pay for legitimate services in a users name and scammers take a cut from the money billed...

Missing support for ERC20 with fee

Lines of code Vulnerability details Impact Contract AaveV3YieldSource allows depositing tokens via supplyTokenTo function. Amount of tokens to transfer is based on passed argument depositAmount and is missing support for tokens with built-in fees. One of the popular tokens that implements such a...

Protocol fees during origination are based on another fee rather than on the loan amount

Lines of code Vulnerability details Impact Protocol fee revenue will be much lower than expected. If the average NFT loaned on the platform is worth $900, openFeeShare will be $9, and protocolFeeShare will be only $0.90. There would have to be more than 50,000 such loans to cover the cost of this...

Staked Citadel function balance and reportHarvest

Lines of code Vulnerability details Impact In the StakedCitadel...

Lender can lose funds

Lines of code Vulnerability details Impact Since some tokens take transfer fees on performing transfer operations and current contract implementation is not considering same, lender funds could be lost Proof of Concept 1. Attacker creates a loan request for token XYZ taking 10% transfer fees 2...

Fees Are Incorrectly Charged on Unfinalized NFT Sales

Lines of code Vulnerability details Impact Once an auction has ended, the highest bidder now has sole rights to the underlying NFT. By finalizing the auction, fees are charged on the sale and the NFT is transferred to auction.bidder. However, if auction.bidder accepts an offer before finalization...