DoS in permitAndMulticall

Lines of code Vulnerability details Impact The permitAndMulticall function does not authenticate the data argument through any signatures. Only the from, amount parameters are as chosen by the from user as these are checked in the permitAndMulticall - ERC20ticket.permit call. An attacker can...

Users Can Frontrun Calls to updateRewardsMetadata() And Claim Tokens Twice

Lines of code Vulnerability details Impact The updateRewardsMetadata function is called by the BribeVault contract by the admin role. The function will take a list of distributions which are used to update the associated reward metadata. It is expected that the merkle root will be updated to...

Users Can Deny The Treasury Manager Contract From Claiming COMP Incentives

Handle leastwood Vulnerability details Impact The treasury manager is appointed by the Notional DAO and is tasked with harvesting rewards both COMP incentives and assets from Notional and performing NOTE buybacks using WETH. The TreasuryManager.harvestCOMPFromNotional function is only callable by...

Locks can be denied

Handle cmichel Vulnerability details The XDEFIDistribution.lock function mints a new token and the generateNewTokenId function returns a token ID as the concatenation of the points and totalSupply + 1: function generateNewTokenIduint256 points internal view returns uint256 tokenId // Points is...

DOS pay function

Handle egjlmn1 Vulnerability details in the pay function users repay their debt and in line 364: it decreases their debt. lets say a user wants to repay all his debt, he calls the pay function with his full debt. an attacker can see it and frontrun to repay a single token for his debt since it's...

Slippage control

Handle pauliax Vulnerability details Impact functions mint and burn of USDV should allow the user to specify min amounts to receive. This would help the user to avoid a huge slippage. Another reason is that price is fetched from lbt but this address can be changed anytime function setLBTwap, so i...

User deposits don't have min. return checks

Handle cmichel Vulnerability details The LPIssuer.deposit first computes balanced amounts on the user's defined tokenAmounts. The idea is that LP tokens give the same percentage share of each vault tokens' tvl, therefore the provided amounts should be balanced, meaning, the depositAmount / tvl...

Race condition on ERC20 approval

Handle WatchPug Vulnerability details function approveaddress spender, uint256 amount public virtual returns bool allowancemsg.senderspender = amount; emit Approvalmsg.sender, spender, amount; return true; Using approve to manage allowances opens yourself and users of the token up to frontrunning...

Frontrunning PublicLock.initialize() can prevent upgrades due to insufficient access control

Handle elprofesor Vulnerability details Impact The unlock protocols base contract Unlock.sol uses setLocktemplate to initialize the implementation contract for the PublicLock proxy. This function will initialize the relevant PublicLock contract which has been deployed separately...

transferFrom function can be frontrun and unusable

Handle pants Vulnerability details A malicious program can frontrun every transaction of transferFromfrom, to, amount where amount is the maximal allowance by frontrunning with transferFromfrom, to, amount/10000 and then the first transaction will fail and only amount / 10000 will be transferred...

Tokens Can Be Stolen By Frontrunning VestedRewardPool.vest() and VestedRewardPool.lock()

Handle leastwood Vulnerability details Impact The VestedRewardPool.sol contract is a public facing contract aimed at vesting tokens for a minimum of 90 days before allowing the recipient to withdraw their mochi. The vest function does not utilise safeTransferFrom to ensure that vested tokens are...

uToken's approve() Function is Susceptible to Frontrunning Attacks

Handle leastwood Vulnerability details Impact Order makers will call the approve function to facilitate transactions between order takers and makers. If a taker sees that a maker is seeking to reduce its order exposure by reducing Swivel.sol's allowance, a taker can frontrun this transaction to...

_addLiquidity will lose user funds due to frontrunning.

Handle tensors Vulnerability details Impact If addLiquidity is ever called with funds at stake anything more than a few thousand dollars it becomes profitable for MEV bots and other frontrunners to frontrun the addLiquidity call by skewing the pool reserves lowering the amount of LP tokens return...

Vault: Withdrawals can be frontrun to cause users to burn tokens without receiving funds in return

Handle hickuphh3 Vulnerability details Impact Let us assume either of the following cases: 1. The vault / protocol is to be winded down or migrated, where either the protocol is halted and withdrawAll has been called on all active strategies to transfer funds into the vault. 2. There are 0...

DOS by Frontrunning NoteERC20 initialize() Function

Handle leastwood Vulnerability details Impact The scripts/ folder outlines a number of deployment scripts used by the Notional team. Some of the contracts deployed utilise the ERC1967 upgradeable proxy standard. This standard involves first deploying an implementation contract and later a proxy...

Bots can frontrun market maker orders and cancel orders.

Handle tensors Vulnerability details Impact Market makers will not be able to have competitive spreads or cancel their orders to update their strategies. It will be difficult for them to provide liquidity on the platform, which will hurt the platform overall. Proof of Concept In traditional finan...

Theo - Ethereum Recon And Exploitation Tool

Theo aims to be an exploitation framework and a blockchain recon and interaction tool. Features: Automatic smart contract scanning which generates a list of possible exploits. Sending transactions to exploit a smart contract. Transaction pool monitor. Web3 console Frontrunning and backrunning...