ergs price problem

Lines of code Vulnerability details No mechanism has been defined for " l2TransactionBaseCost" function. On the other hand, any Oracle is not used in the whole project to get the price of gas, so this whole project will suffer in coordinating between the price of “ergs” in ZK layer and the real a...

Automated Tank Gauge (ATG) Remote Configuration Disclosure Exploit

In 2015, HD Moore, the creator of Metasploit, published an article disclosing over 5,800 gas station Automated Tank Gauges ATGs which were publicly accessible. Besides monitoring for leakage, these systems are also instrumental in gauging fluid levels, tank temperature, and can alert operators wh...

Unchecked array length of the public_inputs[] in Verifier.sol

Lines of code Vulnerability details Impact If an array enumerates all registered addresses, an adversary can register many addresses, causing the problem described above. Vulnerability Details Ethereum is a very resource-constrained environment. Prices per computational step are orders of magnitu...

Unchecked array lenght

Lines of code Vulnerability details Impact If an array enumerates all registered addresses, an adversary can register many addresses, causing the problem described above. Description Ethereum is a very resource-constrained environment. Prices per computational step are orders of magnitude higher...

operator role it's handled in a way that can damage the protocol

Lines of code Vulnerability details operator role it's handled in a way that can damage the protocol Impact Same logic is being deployed several times, for maintainability is hardly recommended to not copy paste same logic many times but inherit it. Also there is an issue in BorrowController with...

recoverERC20 can drain user's funds

Lines of code Vulnerability details recoverERC20 function is deployed so users who have accidently sent erc20 tokens to the contract be able to recover them. recoverERC20 uses ifminAmountRewardTokentoken != 0 revert Errors.CannotRecoverToken; to check if token was set to one of the RewardTokens o...

MED: Some royalty ETH will be stuck in the Holographer contract forever.

Lines of code Vulnerability details Description PA1D.sol's payoutEth function is responsible for distributing ETH holdings in the Holographer. It uses this code: uint256 gasCost = 23300 length + length; uint256 balance = addressthis.balance; requirebalance - gasCost 10000, "PA1D: Not enough ETH t...

Users can avoid paying gas fees

Lines of code Vulnerability details Impact User can avoid paying gas fees by setting gasPrice to 1 wei and gasLimit to 0. Operators will not receive a gas compensation. Also, fallback operators won't be able to pick up such jobs. Proof of Concept 1. Bridging out is a public function that can be...

LayerZeroModule miscalculates gas, risking loss of assets

Lines of code Vulnerability details Description Holograph gets it's cross chain messaging primitives through Layer Zero. To get pricing estimate, it uses the DstConfig price struct exposed in LZ's RelayerV2 The issue is that the important baseGas and gasPerByte configuration parameters, which are...

If user sets a low gasPrice the operator would have to choose between being locked out of the pod or executing the job anyway

Lines of code Vulnerability details During the beaming process the user compensates the operator for the gas he has to pay by sending some source-chain-native-tokens via hToken. The amount he has to pay is determined according to the gasPrice set by the user, which is supposed to be the maximum g...

Reentrance attack to _payoutEth in contract PA1D

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The payoutEth is subject to the reentrancy attack if one of the addresses is a smart contract and has a receive function to call back payoutEth directly or indirectly. The 2300 gas limit might not preve...

Adversary can cause malicious slashing of operators by creating malicous token and setting gas limit above chain block gas limit

Lines of code Vulnerability details Impact Operators maliciously slashed Proof of Concept A user can create a malicious token that when called by anyone other than themselves and the bridge use an extreme amount of gas. They create a bridge request with a gas limit higher than the block limit. If...

MEV: Operator can bribe miner and steal honest operator's bond amount if gas price went high

Lines of code Vulnerability details Description Operators in Holograph do their job by calling executeJob with the bridged in bytes from source chain. If the primary job operator did not execute the job during his allocated block slot, he is punished by taking a single bond amount and transfer it...

Any user asset sent through the bridge can be frozen in limbo by a malicious operator.

Lines of code Vulnerability details Operator can fail transactions causing user to lose their send asset, due to incorrect gas check calculation. Line 416 in Operator. If gasleft = gasLimit + small amount, gas reaching nonRevertingBridgeCall will be 63/64 of casleft - CALL opcode code, which is...

Adversary can cause malicious slashing of operators by setting gas price low

Lines of code Vulnerability details Impact Operators are maliciously slashed Proof of Concept The gas price and limit can be set to whatever the user wishes when calling the bridge. A malicious user could set the gas prices to be low for current chain conditions. This would allow them to use up t...

HIGH: Honest operator can lose their bonded amount although gas price was unacceptable during their slot

Lines of code Vulnerability details Description Operators in Holograph do their job by calling executeJob with the bridged in bytes from source chain. If the primary job operator did not execute the job during his allocated block slot, he is punished by taking a single bond amount and transfer it...

Users can create beam request for a destination chain without paying a fee.

Lines of code Vulnerability details Impact When a user creates a beam request for a destination chain, the user can input zero as a value for gasLimit. With this, the user is able to make the request without paying any fees to Hologram since messagingModule.getHlgFeetoChain, gasLimit, gasPrice;...

_payoutEth() calculates balance with an offset, always leaving dust ETH in the contract

Lines of code Vulnerability details Payout recipients can call getEthPayout to transfer the ETH balance of the contract to all payout recipients. This function makes an internal call to payoutEth, which sends the payment to the recipients based on their associated bp The issue is that the balance...

An attacker can lock operator out of the pod by setting gas limit that's higher than the block gas limit of dest chain

Lines of code Vulnerability details When a beaming job is executed, there's a requirement that the gas left would be at least as the gasLimit set by the user. Given that there's no limit on the gasLimit the user can set, a user can set the gasLimit to amount that's higher than the block gas limit...

_payoutEth() gas computation can make call revert even if balance is sufficient

Lines of code Vulnerability details Payout recipients can call getEthPayout to transfer the ETH balance of the contract to all payout recipients. This function makes an internal call to payoutEth, which computes the gasCost, then proceeds to check balance - gasCost 10000 before sending the result...