An attacker whose a 3% shareholder can wipe-out all the tokens of anyone using a flash-loan

Lines of code Vulnerability details Impact A 3% votes holder can wipe the equity of any other holder using the restructureCapTable function. Proof of Concept 1. a Be a 3% votes holder or have helpers that together have 3% 2. b Reduce the equity to be less than MINIMUMEQUITY This could be done by...

An attacker can contribute to the ETH crowdfund using a flash loan and control the party as he likes.

Lines of code Vulnerability details Impact An attacker can have more than half of the total voting power using a flash loan and abuse other contributors. Proof of Concept The main flaw is that the party can distribute funds right after the crowdfund is finalized within the same block. So the...

CHANGEFEE IS NOT CORRECTLY SCALED IN FLASHLOAN()

Lines of code Vulnerability details Impact changeFee that has been scaled with 4 decimals of of basis points is being adopted by flashloan. This could make the function behave in an unexpected manner than intended. Proof of Concept The fee is calculated as: PrivatePool.solL632 uint256 fee =...

[H-01] RETH oracle manipulation allows attacker to steal funds

Lines of code Vulnerability details Impact The Asymmetry SafEth protocol aims to help diversify and decentralize liquid staking derivatives, exchanging ether staked in the protocol for staked ether derivative tokens based on some relative weighting. A function exposed by these derivative wrapper...

Staking BYTES to Citizen does not extend timelock, allowing attacker to manipulate totalPoints with flash loan

Lines of code Vulnerability details Impact In NeoTokyoStaker, BYTES token can be staked into a Citizen. First, the Citizen must be staked, it will be locked for a timelock duration in Staking contract. Staker want to stake BYTES can specify this Citizen ID and stake into it. However, when users...

Manipulation of livePrice to receive defaultIncentive in 2 consecutive blocks

Lines of code Vulnerability details Impact In StabilizerNode, the default behaviour when twap is below the lower peg threshold all transfers to the amm pool are blocked. However when usePrimedWindow = true, it will only block transfers for primedWindow = 10 blocks. After 10 blocks, the block...

Multiple people can register the same cidNFTID

Lines of code Vulnerability details Impact Multiple people can register the same cidNFT in a way that the same "canonical on-chain identity" can be shared accross multiple real-life identities. Proof of Concept cidNFTs can be transfered as any ERC721 token. After each transfer the new owner can...

Timeswap Options has no reentry check and is providing a set of flashloan with no fees

Lines of code Vulnerability details high-flashloan-provider @timeswap Impact In the file /package/v2-option/TimeswapV2Option.sol, There are a range of functions that has no Reentry check. As a consequence, when the contract call back msg.sender, an attacker can then reeentry in his own callee...

Stealing fund by applying reentrancy attack on removeCollateral, startLiquidationAuction, and purchaseLiquidationAuctionNFT

Lines of code Vulnerability details Impact By applying reentrancy attack involving the functions removeCollateral, startLiquidationAuction, and purchaseLiquidationAuctionNFT, an Attacker can steal large amount of fund. Proof of Concept Bob a malicious user deploys a contract to apply the attack...

LP pricing formula is vulnerable to flash loan manipulation

Lines of code Vulnerability details Impact The LP pricing formula used in the buyQuote, sellQuote, addQuote, removeQuote functions of Pair.sol contract is vulnerable to flash loan manipulation. Proof of Concept The baseTokenReserves calculates the current balance of base token reserves. This...

Attackers can obtain rewards through the NFT of the flash loan winning ID

Lines of code Vulnerability details Impact The contract judges whether the user has won a prize, but only judges whether the owner of the nft with the specified ID is equal to the user's address user == IERC721EnumerableUpgradeablesettings.drawingToken.ownerOf request.currentChosenTokenId ; But i...

Potential race condition when claiming prize

Lines of code Vulnerability details Impact To determine whether a caller has won the raffle, the hasUserWon function of the VRFNFTRandomDraw contract queries the ownerOf function of the drawingToken contract, passing the currentChosenTokenId as argument. In essence, the function is only checking...

Upgraded Q -> M from #215 [1668468272191]

Judge has assessed an item in Issue 215 as M risk. The relevant finding follows: 7. No max fee is set on setFlashLoanFee function There is no max fee set. This allows a malicious owner to set a very high amount of flashloan fee , which allows the malicious admin to grief other users. He can also...

Upgraded Q -> M from #403 [1668467487185]

Judge has assessed an item in Issue 403 as M risk. The relevant finding follows: 1. No upper limit check on flash loan fee No upper limit check on setFlashLoanFee. Although only admin can set this, human error can lead to higher percente swap, leading to excess swap and gas fee. Or admin can rug...

Upgraded Q -> M from #70 [1668468349340]

Judge has assessed an item in Issue 70 as M risk. The relevant finding follows: Flash loan fee can be set to 100% Contract: Issue: In setFlashLoanFee function, If Admin has set flashloan fee to 100% then user taking X amount as flashloan has to pay a fee equal to X which does not make sense...

Upgraded Q -> M from #194 [1668467876517]

Judge has assessed an item in Issue 194 as M risk. The relevant finding follows: L-04 Should be a upper-bound on Flash-loan fee There are 1 instances of this issue: File : = Recommended Mitigation There should be a upper bound of Flash-loan fee define in contract so that owner can't able to set f...

fake flash loan can grief the pool

Lines of code Vulnerability details there is a scenario where an attacker/griefer can use flash function and trick the pool to think he has paid the flash and the fee while he was only paying back the flash. about double/multiple erc20 tokens : some erc20 tokens have multiple entry points . those...

The price be manipulated when the liquidity is thin because the flashloan feature and swap feature are present at the same time in algebra pool

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. the price curve pool in the application is xy = k with price range and centralized liqudiity, when the liquidity is thin, the price can be easily manipulated at the favor of malicious user because the...

Users can regain gobblers they use to mint Legendary Gobbler with.

Lines of code Vulnerability details Impact Users can mint legendary gobblers without actually burning their gobblers by using the GobblersERC721.approve function to approve themselves before minting their legendary gobbler the burn mechanism, doesn't delete the getApproved approved entry for that...

an attacker can take out flash loan and cause users not to be able to redeem their tokens because of undflow or divsion by zero

Lines of code Vulnerability details Impact An attacker can take out a flash loan and cause the state variable redeemBase=1 causing users who call this function to get dosed and since users can't call this function after the attacker makes the reedem function unuseable which can cause funds to be...