Withdraw fee discounting using self rigidRedemption

Lines of code Vulnerability details Description There is no restriction for self rigidRedemption so that allows one to repay and withdraw instantly part of the collateral. That allows us to instantly withdraw with less fee paid. Impact It may be used for malicious scenarios with flashloan for...

Flashloan/onFlashLoan() does not comply eip-3156

Lines of code Vulnerability details Impact In PeUSDMainnetStableVision.sol, File: contracts/lybra/token/PeUSDMainnetStableVision.sol interface FlashBorrower /// @notice Flash loan callback /// @param amount The amount of tokens received /// @param data Forwarded data from the flash loan request /...

stETHs rebase profit stealing

Lines of code Vulnerability details Description It's possible with flashloan from AAVE to capture a big shares amount of eUSD, after each stETH rebase exploiter will buy excessive income, which leads to eUSD rebase due to shares burning, so the exploiter will have most of burned eUSD because they...

Upgraded Q -> 2 from #680 [1683016846473]

Judge has assessed an item in Issue 680 as 2 risk. The relevant finding follows: D. FlashFee is a flat amount, meaning the cost to flash loan an NFT at floor price is the same as one worth 5x the floor price. FlashFee should instead be based on the weigh of the NFT being flashloaned, with more...

CHANGEFEE IS NOT CORRECTLY SCALED IN FLASHLOAN()

Lines of code Vulnerability details Impact changeFee that has been scaled with 4 decimals of of basis points is being adopted by flashloan. This could make the function behave in an unexpected manner than intended. Proof of Concept The fee is calculated as: PrivatePool.solL632 uint256 fee =...

Reth flashloan attack

Lines of code Vulnerability details Impact Using a flashloan to manipulate rETH/ETH price a hacker can receive more SafEth shares for the same amount of ether, thus draining all three derivative contracts rETH, SfrxEth and WstEth. Proof of Concept Reth.poolPrice depends on UniswapV3 pool.slot0...

Risk of flashloan attacks in the Staking contract

Lines of code Vulnerability details Impact An attacker can steal a large amount of rewardsToken from the Staking contract by using flashloans, thus all the users will receive less rewards for their staked amounts. Proof of Concept In the Staking contract any user can stake a given amount of...

No-check taht amounts are less than reserves

Lines of code Vulnerability details Impact There is no check that the amount for the flashloan is actually available in the contract. It is checked that it should be 0 but not than reserves. Eventually, the function will revert because the funds are not there and the funds are not in the contract...

Loss of funds - User has control of the fallback function

Lines of code Vulnerability details Imapct: Lendengine check the balanceBefore and after of token1, after sending tokens via a mintFallback function. During this fallback the user has access to theses tokens so far as it's returned + collateral the fallback is satisfied. A attacker can take out...

LP token is vulnerable to flashloan manipulation

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The addQuote function in the pair.sol smart contract utilizes a pricing formula for liquidity pools that is susceptible to exploitation through flashloan manipulation. By introducing a large quantity of...

The way the winner claiming NFT is vulnerable to flashloan attack.

Lines of code Vulnerability details Impact The way the winner claiming NFT is vulnerable to flashloan attack. Proof of Concept This kind of attack is similar to ApeCoin Airdrop attack. To determine who is winng the current drawing, there is a hashUserWon function: function hasUserWonaddress user...

User can pass auction recovery health check easily with flashloan

Lines of code Vulnerability details Description ParaSpace features an auction mechanism to liquidate user's NFT holdings and receive fair value. User has the option, before liquidation actually happens but after auction started, to top up their account to above recovery factor 1.5 instead of 1 an...

´userAccrue` rewards manipulation

Lines of code Vulnerability details Impact A flashloan can be used to set a huge last balance which later will accrue a huge reward. Proof of Concept Buy lots of a rewards-producing token, possibly by means of a flashloan. Call PirexRewards.userAccrue which sets u.lastBalance to this now very hig...

Upgraded Q -> M from #474 [1668467584757]

Judge has assessed an item in Issue 474 as M risk. The relevant finding follows: L-01 Flashloan fee is not validated flashLoanFee is determined at LBFactory's constructor as; constructoraddress feeRecipient, uint256 flashLoanFee setFeeRecipientfeeRecipient; flashLoanFee = flashLoanFee; emit...

Use of globalState.unlocked state change outside lock modifier allows for Re-entrancy which would cause huge loss to pool

Lines of code Vulnerability details I guess I can put this into one report since the issue affects two seperate functions in a contract. Impact The functions AlgebraPool.swap and AlgebraPool.swapSupportingFeeOnInputTokens attempt to not use the lock modifier to update the globalState.unlocked sta...

Malicious code in flashloan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b318d8644a2e5f56d435a65d5df7d81c078bdf2f95b231006a90d5dc67bdb754 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3069 Malicious code in flashloan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b318d8644a2e5f56d435a65d5df7d81c078bdf2f95b231006a90d5dc67bdb754 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[NAZ-H1] syncRewards() Can be Front-Run With A Flashloan To Force lastRewardAmount To Equal Zero

Lines of code Vulnerability details Impact A malicious user can front run syncRewards with a flashloan attack to cause lastRewardAmount to equal zero. With this users will lose on rewards until the next rewardsCycleEnd. Proof of Concept 1. Alice calls deposit with 1000 tokens storedTotalAssets =...

NFT flashloan against governance voting

Lines of code Vulnerability details Impact Specifically, to support a proposal, the voting power is counted at the time of the proposal creation time. However, there are multiple services that support NFT flashloan, e.g., NFTuloan . Since the voting power is counted as the proposal creation time,...

TWAP LP price manipulation

Lines of code Vulnerability details Impact The total value locked sum of the pair is used to price the LP. But the reserves of the underlying can be easily influenced by flashloan, then the TVL can vary dramatically.Just like what happened before here Warp. Although getPriceLP use TWAP to calcula...