Adversary can cause malicious slashing of operators by setting gas price low

Lines of code Vulnerability details Impact Operators are maliciously slashed Proof of Concept The gas price and limit can be set to whatever the user wishes when calling the bridge. A malicious user could set the gas prices to be low for current chain conditions. This would allow them to use up t...

Frontrunning initialize to negatively affect first liquidity provider possible

Lines of code Vulnerability details Impact The initialize-function of an AlgebraPool can be frontrun to set an arbitrary initial price. This will negatively affect the first person to add liquidity to the pool. Proof of Concept There are no restrictions on the AlgebraPool.initializeprice function...

Frontrunning by malicious validator

Lines of code Vulnerability details Impact Frontrunning by malicious validator changing withdrawal credentials Proof of Concept A malicious validator can frontrun depositEther transaction for its pubKey and deposit 1 ether for different withdrawal credential, thereby setting withdrawal credit...

Race condition on vesting revokes

Lines of code Vulnerability details Impact Race condition with vesting revokes, frontrunning decides who gets the funds. Proof of Concept An admin can revoke a vesting for a given receiver. Revoking will disallow the receiver to get his already released tokens since active will be set to false an...

A malicious user could stuck crowdfund ETH

Lines of code Vulnerability details Impact A user could freeze funds accumulated in a crowdfund and execute a "fake sale" that would be the approval of the token. Proof of Concept A group of users create a crowdfund, they raise money to buy the most good looking Bored Ape. An attacker would buy i...

Zero approval missing

Lines of code Vulnerability details Impact Frontrunning is possible where user withdraw money before setApproval refill the approval limit. This allows User to get more funds than required Proof of Concept 1. User A is approved an amount of 50 2. "custodian" decides to reduce the approval amount ...

Possible frontrunning attack in Vault.

Lines of code Vulnerability details Impact First depositor will have the control of the vault and drain user funds. Proof of Concept The project uses VaultAccount.sol library for math implementations. To determine the number of shares to mint to a depositor, shares = amount total.shares /...

Possible frontrunning attack in Vault.

Lines of code Vulnerability details Proof of Concept The project uses VaultAccount.sol library for math implementations. To determine the number of shares to mint to a depositor, shares = amount total.shares / total.amount is used in toShares function VaultAccount.sol's toShares calculation;...

A malicious delegatee can always block the delegator from undelegating the lock

Lines of code Vulnerability details Impact A user who has delegated his/hers voting power to a delegatee can break his/hers delegate only by submitting a lock with a higher expiration time than the delegatee after a successful call to increaseUnlockTime function. After that, he has to call the...

Attacker can frontrun and reenter this function causing users to get griefed

Lines of code Vulnerability details Impact 1. attacker calls createFor and there is reentracy in safemint and an attacker can reenter and just keep increasing count just a side note 2. but what an attacker can do is when a user wants to call this function or launch a project an attacker frontruns...

instantUnstake function can be frontrunned with fee increase

Lines of code Vulnerability details Impact instantUnstake allows user to unstake their stakingToken for a fee paid to the liquidity providers. This fee could be changed up to 100% any moment by admin. Malicious admin could frontrun users instantUnstake transaction and set fee to any value using...

Admin can set arbitrarily high exchange fees

Lines of code Vulnerability details Impact Admins can attack users by frontrunning them Poc In the function setProtocolFeeInfinityExchange.sol function setProtocolFeeuint16 protocolFeeBps external onlyOwner PROTOCOLFEEBPS = protocolFeeBps;@audit medium emit NewProtocolFeeprotocolFeeBps; Admins ca...

Withdrawing all funds at once to vault can be DoS attacked by frontrunning and locking dust

Lines of code Vulnerability details Impact All funds can be migrated withdrawn at once to the caller vault by using the BaseStrategy.withdrawToVault function which internally calls MyStrategy.withdrawAll. The latter function has the following check in place: MyStrategy.solL184-L187 require...

THE FIRST AMM STAKER WILL HAVE CONTROL OVER HOW THE SHARES ARE CALCULATED

Lines of code Vulnerability details Impact The first staker can take control of how the subsequent shares are going to be distributed by simply staking 1wei amount of the token and frontrunning future stakers. The reasons of this are related on how the variables are updated and with the amounts...

Frontrunning Private Trades Vulnerability

Lines of code Vulnerability details Impact The inability to create private trades in the Seaport contract would affect users significantly. Users will be forced to create public trades that run the risk of being frontrun. Proof of Concept Today, all trades are private meant for specific offerer a...

Creator of the contract could front run tax per capita to 100% of Yield rewards

Lines of code Vulnerability details Impact Contract creator could steal all rewards using frontrunning Proof of Concept When a yield pool is created pool tax is set equal to global tax and funds are sent into the contract to pay for rewards. The contract creator could set tax to 100% in a...

Use Victims Collateral by Frontrunning

Lines of code Vulnerability details Issue: the require statement in requestLoan doesn't check if the one that provides the collateral is the same address that requests the loan Consequences: If an NFT is transferred to the contract by itself, either on accident or preparing to call requestLoan wi...

Borrower can frontrun lender's call to lend to change the price oracle

Lines of code Vulnerability details Impact In NFTPairWithOracle.lend, params.oracle is not checked. This allow a borrower to watch the mempool and front-run the lender's call and change oracle to avoid liquidation. Proof of Concept function lend address lender, uint256 tokenId, TokenLoanParams...

Option create can be denied

Lines of code Vulnerability details Proof of Concept A griefer can frontrun the createOption from a user and user's tx will revert. This line will revert because of this Recommended Mitigation Steps One gas efficient way to prevent this is to mix msg.sender into salt. --- The text was updated...

Frontrunning of setPerTokenWalletCap edge case

Lines of code Vulnerability details Impact The setPerTokenWalletCap function in WhitelistPeriodManager.sol contains a comment stating: Special care must be taken when calling this function There are no checks for perTokenWalletCap since it's onlyOwner, but it's essential that it should be = max l...