Call() should be used instead of transfer() on an address payable

Lines of code Vulnerability details Impact The use of the deprecated transfer function for an address will inevitably make the transaction fail when : 1. The withdrawer smart contract does not implement a payable fallback function. 2. The withdrawer smart contract implements a payable fallback...

Usage of deprecated transfer to send ETH

Lines of code%20%7B-,payablemsg.sender.transfer,-msg.valueL183 Vulnerability details Impact The use of the deprecated transfer function for an address will inevitably make the transaction fail when: The claimer smart contract does not implement a payable function. The claimer smart contract does...

ETHRegistrarController's register and renew use payable.transfer calls with an arbitrary receiver

Lines of code Vulnerability details ETHRegistrarController's register and renew transfer out remainder native tokens via payableto.transfer call. This is unsafe as transfer has hard coded gas budget and can fail when msg.sender is a smart contract. Such transactions will fail for smart contract...

Use Call Instead of Transfer for Address Payable

Lines of code Vulnerability details Impact It is recommended to avoid the usage of payable.transfer, since it can cause the transaction to fail when the user is accessing this function with a smart contract and: 1. does not have payable function 2. have a payable function but spends more than 230...

Accidentally cancel order

Lines of code Vulnerability details Accidentally cancel order Impact Some market maker's limit order might be accidentally cancelled, and has to be resubmitted again. If the user did not do this on purpose, without knowing the fact that the order has been cancelled, it may lead to unexpected...

Usage of deprecated transfer to send ETH

Lines of code Vulnerability details Impact Transaction can revert Proof of Concept The original transfer used to send ETH uses a fixed stipend of 2300 gas. This was used to prevent reentrancy. However, this limit your protocol to interact with others contracts that need more than that to proceess...

Upgraded Q -> M from 270 [1657580410834]

Judge has assessed an item in Issue 270 as Medium risk. The relevant finding follows: 6.L- Admin config ProtocolFee and gasFee missing max amount check which can be used to take fund from user With PROTOCOLFEEBPS 10000 more than 100%, the exchange can steal user WETH who might approve max WETH...

Upgraded Q -> M from 270 [1657580270573]

Judge has assessed an item in Issue 270 as Medium risk. The relevant finding follows: 6.L- Admin config ProtocolFee and gasFee missing max amount check which can be used to take fund from user With PROTOCOLFEEBPS 10000 more than 100%, the exchange can steal user WETH who might approve max WETH...

The splits configuration will become frozen once enough splits are added

Lines of code Vulnerability details Impact If there are enough entries in the splits array, the checks done to ensure existing locks are respected will cause attempts to change the split to revert, preventing the existing split assignment from changing. If the project has a lock with a long...

Distribution of reserved tokens may run out of gas

Lines of code Vulnerability details Impact If there are enough entries in the splits array, the function that distributes the reserved tokens will run out of gas, and the reserved tokens will be un-distributable until the current cycle is over, and the splits are changed. If cycles are long, the...

Issue with condition check handling

Lines of code Vulnerability details Impact It might cause data corruption, as most of the data handling is done in low level. Proof of Concept // Add up all the percents to make sure they cumulative are under 100%. uint256 percentTotal = 0; for uint256 i = 0; i typeuint56.max revert...

JBPayoutRedemptionPaymentTerminal#processFees may run out of gas and revert due to long list of _heldFeesOf[_projectId]

Lines of code Vulnerability details Proof of Concept // Get a reference to the project's held fees. JBFee memory heldFees = heldFeesOfprojectId; // Delete the held fees. delete heldFeesOfprojectId; // Push array length in stack uint256 heldFeeLength = heldFees.length; // Process each fee. for...

JBDirectory.primaryTerminalOf might suffer from out of gas DoS if too many terminals are added through JBDirectory._addTerminalIfNeeded

Lines of code Vulnerability details Impact There is no limit to the size of terminalsOf. if too many terminals are added through JBDirectory.addTerminalIfNeeded. JBDirectory.primaryTerminalOf might suffer from out of gas DoS. Proof of Concept The for loop in JBDirectory.primaryTerminalOf may caus...

Sending batch withdrawal requests can possibly DoS

Lines of code Vulnerability details Impact The function BatchRequests.sendWithdrawalRequests allows calling the sendWithdrawalRequests function on all of the Yieldy contracts at once. However, due to the unbounded for loop, if many Yieldy contracts are added to contracts, this function can...

instead of call() , transfer() is used to withdraw the ether

Lines of code Vulnerability details Impact To withdraw eth it uses transfer, this trnansaction will fail inevitably when : - The withdrwer smart contract does not implement a payable function. Withdrawer smart contract does implement a payable fallback which uses more than 2300 gas unit Thw...

ProxyVault implementation can be changed retroactively bricking old NibblVaults

Lines of code Vulnerability details Impact The ProxyVault.sol contract refers back to the NibbleVaultFactory.vaultImplementation This value can change over time, potentially breaking storage of the old implementations. Notice that querying the implementation from NibbleVaultFactory also incurs a...

REENTRANCY-Avoid transfer() as reentrancy mitigations. Transfer do not protect from reentrancies in case of gas price changes.

Lines of code Vulnerability details Impact --Check: reentrancy-unlimited-gas --Severity: Informational --Confidence: Medium Transfer and send have been recommended as a security best-practice to prevent reentrancy attacks because they only forward 2300 gas. That being said, gas repricing of...

Buys/sells will be front-run by MEV bots

Lines of code Vulnerability details Impact Since the value of the vault depends on the Bancor formula, it's important that transactions can't be front-run, because doing so, even for small amounts, will change the valuation price for subsequent buys/sells. The link the sponsor provided describes...

Malicious code in onchain-gas-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdc3044f72d0fca8f6b38e910c43238dea4d108eadcdedce1ee911394dac85d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Incorrect calculation of startGasPerOrder will cause fund loss to the buyer of the last order due to mischarged gas cost

Lines of code Vulnerability details uint256 gasCost = startGasPerOrder - gasleft + wethTransferGasUnits tx.gasprice; When the orders are matched by the MATCHEXECUTOR, the gas cost of each order is paid by the buyer in WETH, the amount gasCost is calculated based on startGasPerOrder, gasleft and...