Lender.sol amountIn is used as returned for Pendle

Lines of code Vulnerability details uint256 returned; // Add the accumulated fees to the total uint256 fee = calculateFeea; feesu += fee; address memory path = new address; path0 = u; path1 = principal; // Swap on the Pendle Router using the provided market and params returned =...

Rug vector for admin of Lender.sol who can max approve all principal tokens for any market without waiting the 3 days to themselves

Lines of code Vulnerability details Impact The admin of Lender.sol is authorized to call the function approve which will grant any address max approval over the principal tokens of a particular market. I assume that this functionality is used to approve the respective redeemer contracts used in...

Uninitialized local variables

Lines of code Vulnerability details Impact Configuration -Check: uninitialized-local -Severity: Medium -Confidence: Medium -Description:Lender.approveaddress,address.i Lender.sol114 is a local variable never initialized.A smart contract with uninitialized local variables may lead to intentional...

lend() to Tempus will return less than expected or just revert

Lines of code Vulnerability details function lend uint8 p, address u, uint256 m, uint256 a, uint256 r, uint256 d, address t, address x public unpausedp returns uint256 // Instantiate market and tokens address principal = IMarketPlacemarketPlace.marketsu, m, p; if ITempusprincipal.yieldBearingToke...

if attacker gets admin private key then he can drain all the tokens that Lender.sol contract holds

Lines of code Vulnerability details Impact if attacker gets admin private key then he can drain all the tokens that Lender.sol contract holds Recommended Mitigation Steps make it harder for admin to do this with some internal sec requirements --- The text was updated successfully, but these error...

Inaccurate fee calculation

Lines of code Vulnerability details Impact The equation in the calculateFee function has a high degree of inaccuracy Solidity use integers, when divide an uint256 for other uint256 the divition take the floor number and ignore the decimal part In example: a = 1999 ETH feenominator = 1000 the retu...

Reentrancy vulnerabilities

Lines of code Vulnerability details Impact Reentrancy attacks can allow malicious actors to take over the control flow, and make...