No validation for the partyFactory contract !

Lines of code Vulnerability details Impact Malicious party contract can be deployed ! Proof of Concept Party contracts are created by the proxyFactory contract . In the initialize function , the proxyFactory contract address is provided by the user which may bring catastrophic consequences . This...

Users can lose eth when contributing.

Lines of code Vulnerability details Impact When contributing in InitialETHCrowdfund, if minting adjusts the voting power for that user to cap it at totalVotingPower, the user does not get refunded the eth he lost. Proof of Concept PartyGovernanceNFTmint caps the mintedVotingPower at...

InitialETHCrowdfund + ReraiseETHCrowdfund: Gatekeeper checks wrong address

Lines of code Vulnerability details Impact This vulnerability exists in both the InitialETHCrowdfund and ReraiseETHCrowdfund contracts in exactly the same way. I will continue this report by explaining the issue in only one contract. The mitigation section however contains the fix for both...