No incentive mechanism for allowed senders to call finalizeWithdrawal on behalf of withdrawers.

Lines of code Vulnerability details Impact Since finalizeWithdrawal is a permissioned function, if there are no mechanism in place for allowed senders to trigger it, withdrawers would not able to receive their funds in a timely fashion. Proof of Concept The withdrawal functions such...

Calling borrowAsset function with 0 _collateralAmount can borrow asset tokens without providing any collateral tokens

Lines of code Vulnerability details Impact The borrowAsset function can be called with the collateralAmount input being set to 0. This will successfully bypass the step for providing any collateral tokens while directly borrowing the asset tokens. When a borrower borrows assets without providing...

User does not get commission

Lines of code Vulnerability details Impact If Auctioned Vault debt is cleared from external source depositing extra collateral, auction can be cancelled prematurely. In this case auctioneer loses his commission. User must be given commission once auction starts at auctionStarted. Note Also it see...

AuraLocker kick reward only takes last locked amount into consideration, instead of whole balance

Lines of code Vulnerability details The issue occurs in AuraLocker, when expired locks are processed via kicking, and if all the user locks have expired. In this scenario, to calculate the kick reward, processExpiredLocks multiplies the last locked amount by the number of epochs between the last...

sNOTE Holders Are Not Incetivized To Vote On Proposals To Call extractTokensForCollateralShortfall

Handle leastwood Vulnerability details Impact As sNOTE have governance voting rights equivalent to the token amount in NOTE, users who stake their NOTE are also able to vote on governance proposals. In the event a majority of NOTE is staked in the sNOTE contract, it doesn't seem likely that stake...

Possible incentive theft through the arbitraryCall() function

Handle toastedsteaksandwich Vulnerability details Impact The Locke.arbitraryCall function allows the inherited governance contract to perform arbitrary contract calls within certain constraints. Contract calls to tokens provided as incentives through the createIncentive function are not allowed i...

arbitraryCall allow inherited governance to steal incentives

Handle gzeon Vulnerability details Impact arbitraryCall did not check the balances of incentives, which allow inherited governance to steal the incentives. Proof of Concept Recommended Mitigation Steps Keep track of incentive token addresses in createIncentive and check the balance of each token...

arbitraryCall enables streamCreator to remove incentive tokens before endStream

Handle bitbopper Vulnerability details Impact streamCreator can remove incentive tokens before endStream by calling approve on the token beforehand. streamCreator has following methods of attack: guess from whom and with what he is going to be incentiviced listen in the mempool and win PGA in ord...

Locke.sol:Stream - arbitraryCall can be used to drain incentive tokens

Handle ScopeLift Vulnerability details Impact Governor can drain incentive balance via arbitraryCall Proof of Concept The Stream contract offers createIncentive and claimIncentive which is the way the contract "expects" incentives to go. Access to claiming incentives is limited to the stream...

CVE-2021-35585

Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Incentive...

CVE-2021-35585

Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Incentive...

Design/Logic Flaw

Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Incentive...

CVE-2021-35585

Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Incentive...

CVE-2021-35585

CVE-2021-35585 is a documented vulnerability in the Oracle Incentive Compensation UI of Oracle E-Business Suite. Affected, supported versions are 12.1.1–12.1.3. The issue is exploitable by a low-privilege, network-accessible attacker over HTTP, leading to unauthorized creation/deletion/modificati...

CVE-2021-35585

Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Incentive...

CVE-2021-35585: Undefined Security Weakness

Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Incentive...

Unclaimed rewards are not deducted when reclaiming an incentive

Handle broccoli Vulnerability details Impact The reclaimIncentive function of ConcentratedLiquidityPoolManager does not update the rewardsUnclaimed variable after some rewards are reclaimed. Thus, an attacker could add an incentive with a corresponding token, such as DAI, and reclaim the incentiv...

ConcentratedLiquidityPoolManager uses wrong index for incentive

Handle cmichel Vulnerability details The ConcentratedLiquidityPoolManager uses the positionId as an index for incentivespoolpositionId when it should be incentiveId instead: // @audit should be Incentive memory incentive = incentivespoolincentiveId; Incentive memory incentive =...

Wrong usage of positionId in ConcentratedLiquidityPoolManager

Handle broccoli Vulnerability details Impact In the subscribe function of ConcentratedLiquidityPoolManager, the incentive to subscribed is determined as follows: Incentive memory incentive = incentivespoolpositionId; However, positionId should be incentiveId, a counter that increases by one...

ConcentratedLiquidityPoolManager: reclaimIncentive() does not decrement rewardsUnclaimed

Handle hickuphh3 Vulnerability details Impact reclaimIncentive withdraws any unclaimed rewards to the incentive owner. While there is a check to prevent re-claiming of rewards requireincentive.rewardsUnclaimed = amount, "ALREADYCLAIMED"; it is ineffective because incentive.rewardsUnclaimed is not...