withdrawFee() can be called indefinitely

Lines of code Vulnerability details The function withdrawFee does not account whether the fees have already been collected or not, therefore it can be called multiple times or even indefinitely, until the contract balance reaches zero. All funds will be transferred to the protocolFeeRecipient, bu...

driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people.

Lines of code Vulnerability details Impact driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people. Proof of Concept In contract dripsHub their is no mechanism to check a user already registered under driverID or no...

Using V2-Pool, user can loose money after minting, then burn due to duration calculation

Lines of code Vulnerability details Impact Users loose money over time after mint using V2-Pool due to the protocol duration calculation. The current duration calculation is calculated from now to maturity. So when the user mint, then burn the liquidity, with time the amount of short he get is...

user funds loss in withdraw() of StRSR because code don't revert when calculated rsrAmount is zero

Lines of code Vulnerability details Impact Function withdraw in StRSR completes an account's unstaking. but when calculated amount of RSR token is 0 code still burn user draftRSR and returns. This would cause users small amount of deposits to get burned and user won't receive any funds. as withdr...

function withdraw() in StRSR won't update contract state (totalDrafts) in all cases which can cause wrong fund distribution and fund stucking in the contract

Lines of code Vulnerability details Impact Function withdraw complete an account's unstaking. it transfers user draft withdrawals and updates totalDrafts. but when calculated rsrAmount is 0 code returns and won't updates totalDrafts which can cause wrong calculations as those draft items removed...

Small amounts of funds can be stolen during recollateralization

Lines of code Vulnerability details Impact This is similar to the "high" vulnerability I submitted but shows a similar exploit can be done if a user isn't a whale, stealing a smaller amount of funds. This is potentially a "high" risk depending on how easy you think execution is. I think it's...

Solmate safetransfer and safetransferfrom does not check the codesize of the token address, which may lead to fund loss

Lines of code Vulnerability details Impact Possible miscalculation and loss of funds. Proof of Concept In AstariaRouter.commitToLiens, the safetransfer and safetransferfrom doesn’t check the existence of code at the token address. This is a known issue while using solmate’s libraries.Hence this m...

SmartAccount wallet creation can be backdoored

Lines of code Vulnerability details At wallet creation time, an attacker can temporarily swap the address of the entrypoint to install a backdoor in the form of a registered module in the wallet. Since wallets don't necessarily need to be created by their owners, an attacker can frontrun the wall...

Attacker can gain control of counterfactual wallet

Lines of code Vulnerability details A counterfactual wallet can be used by pre-generating its address using the SmartAccountFactory.getAddressForCounterfactualWallet function. This address can then be securely used for example, sending funds to this address knowing in advance that the user will...

Failed transactions may lead to fund loss via replay attacks

Lines of code Vulnerability details Impact Failed transactions inside executeTransaction will revert and make the nonces remain intact. Thus a replay attack with signature arguments is possible. Proof of Concept One can make replay attacks with the reverted executeTransaction function and reprodu...

Upgraded Q -> M from #173 [1673098404536]

Judge has assessed an item in Issue 173 as M risk. The relevant finding follows: L-03 - Depreciating-soon selfdestruct is used to transfer funds to seller after sale ends. --- The text was updated successfully, but these errors were encountered: All reactions...

Design/Logic Flaw

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds...

CVE-2022-48216

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds...

CVE-2022-48216

The CVE-2022-48216 issue affects Uniswap Universal Router versions prior to 1.1.0. A reentrancy mishandling in the router could allow theft of funds. Impact is described as high (CVE metrics indicate network exposure with high confidentiality, integrity, and availability impact). Remediation per ...

SOLMATE SAFETRANSFER AND SAFETRANSFERFROM DOES NOT CHECK THE CODESIZE OF THE TOKEN ADDRESS, WHICH MAY LEAD TO FUND LOSS

Lines of code Vulnerability details Impact Reference from a previous Contrest : In uniswapV3SwapCallback and sendPaprFromAuctionFees the safetransfer and safetransferfrom doesn’t check the existence of code at the token address. This is a known issue while using solmate’s libraries. Hence this ma...

code doesn't check that To address is not 0x0 in contract function, if user call contract's function with wrong value he would lose his funds

Lines of code Vulnerability details Impact There is no sanity checks when user wants to get loan or ... for a to address and if the value of to set as 0 user would lose those funds. Proof of Concept none of the functions increaseDebtAndSellmintTo, , increaseDebtmintTo, ,...

Stealing fund by applying reentrancy attack on removeCollateral, startLiquidationAuction, and purchaseLiquidationAuctionNFT

Lines of code Vulnerability details Impact By applying reentrancy attack involving the functions removeCollateral, startLiquidationAuction, and purchaseLiquidationAuctionNFT, an Attacker can steal large amount of fund. Proof of Concept Bob a malicious user deploys a contract to apply the attack...

_transferFrom() in Pair contract doesn't update approval amounts when transferring user fractional tokens

Lines of code Vulnerability details Impact Contract Pair is and ERC20 token which represents user fractional token balance and it has all the features of the standard ERC20 tokens. function transferFrom has been written for transferring token but the logic isn't complete and it doesn't consider...

Stealing liquidity provider's fund by manipulating the reserve

Lines of code Vulnerability details Impact An attacker can steal liquidity provider's fund by manipulating the reserve. During adding a liquidity, the amount of lpToken to be minted will be calculated in the function addQuote. function addQuoteuint256 baseTokenAmount, uint256 fractionalTokenAmoun...

LP's ERC20 tokens cannot be rescued when owner closes the pair

Lines of code Vulnerability details Impact LP cannot be rescued when owner closes the pair. Aside from the NFT which can be salvaged through Pair.withdraw, the ERC20 token amounts cannot be rescued, resulting in fund loss. Proof of Concept In case of any malicious attempt to grief the protocol, t...