The vault account amount can be the result of an overflow

Lines of code Vulnerability details Impact The downcast uint128amountToTransfer can result in an overflow, which would impact the totalAsset.amout local variable, resulting in an incorrect amount for the totalAsset.amount state variable. function withdrawFeesuint128 shares, address recipient...

VaderReserve.reimburseImpermanentLoss improperly converts USDV to VADER

Handle TomFrenchBlockchain Vulnerability details Impact IL isn't properly converted from being in terms of USDV to VADER, resulting in reserve paying out incorrect amount. Proof of Concept VaderReserve.reimburseImpermanentLoss receives an amount in terms of USDV and converts this to an amount of...

Controller.withdrawAll sets wrong vault balance

Handle cmichel Vulnerability details The Controller.withdrawAll decreases the vault balance by amount, the want token amount that has been withdrawn from the strategy and transferred to the vault. Note that amount gets overwritten in the convert != address0 branch and is a convert token value...