Malicious users can frontrun borrowers trying to repay loans, causing DoS and possibly a loan default

Lines of code Vulnerability details Impact Attackers can listen for a borrower to call repayAndCloseLoan on a specific loanId, and frontrun their transaction with a call to lend, creating a new loan with an increased amount, causing the borrower's transaction to fail due to the new loanAmount bei...

Loan can not be repaid when the BorrowTicket's owner is a contract with no onERC721Received method

Lines of code Vulnerability details In repayAndCloseLoan, after the loan is repaid, the Collateral NFT will safeTransferFrom addressthis to the owner of the BorrowTicket NFT, which is the mintBorrowTicketTo used in createLoan, must implement the onERC721Received method for the safeTransferFrom to...

Facilitator fee is higher than it should be if loan asset has fees on transfer

Lines of code Vulnerability details Impact When the lend asset is a token with fees on transfer, the facilitator fee is higher than it should be. The contract doesn't use the actual token amount it received but the one where the fees aren't subtracted yet. This causes the borrower to receive fewe...

Can force borrower to pay huge interest

Lines of code Vulnerability details Impact The loan amount is used as a min loan amount. It can be matched as high as possible realistically up to the collateral NFT's worth to remain in profit and the borrower has to pay interest on the entire amount instead of just on the desired loan amount wh...

loan amount is unbounded

Lines of code Vulnerability details The lender of a loan can lend an unbounded amount, which the borrower might not be able to pay its interest rate. Proof of Concept Alice wants to borrow 1000 USDC, she creates a loan with a 10% interest rate, and expects to pay 100 USDC after a year. Bob lends...

Allowing the lender to finalize a loan with an arbitrarily high amount can cause the borrower to default

Lines of code Vulnerability details Impact A borrower specifies a minimum loan amount. The lender can provide a loan as high as they want. As long as it's higher than the minimum value. A value too high might cause the borrower to not be able to pay it back. A higher loan means a higher facilitat...

Bad Incentives For Lenders Who Buy Out Other Lenders

Lines of code Vulnerability details Impact Lenders are allowed to "buy out" another lender on a position via the loan function. This is supposed to be a purely positive sum action for the borrower, as the new lender must provide "better" terms than their predecessor, as checked here: However, in...

Lender can lose funds

Lines of code Vulnerability details Impact Since some tokens take transfer fees on performing transfer operations and current contract implementation is not considering same, lender funds could be lost Proof of Concept 1. Attacker creates a loan request for token XYZ taking 10% transfer fees 2...

NFTLoanFacilitator: Insufficient granularity allows for same-term loans to be accepted

Lines of code Vulnerability details Details & Impact It is possible for the calculated interest rate improvement to be zero if the existing interest rate is low enough ≤ 0.9% with 10% improvement rate. In such cases, lenders can compete to continually buyout each other with the same terms. The...

Borrower may be forced to pay more interest than he expected

Lines of code Vulnerability details Impact Creating a loan with a minimum amount, instead of a fixed/maximum amount may lead to forcing the borrower to pay more interest than he was expecting or hoping for. The user never knows the potential maximum amount he will need to pay, until the loan is...

Borrower collateral can be stolen

Lines of code Vulnerability details Impact In case of collateral price fluctuation, lender can create a situation where borrower would be unable to repay the loan and lender could get hold of collateral Proof of Concept 1. User creates a loan request for duration 1 day and minimum amount as 0.1...

Function getPastDelegate may return incorrect values

Lines of code Vulnerability details Impact By calling delegate function of HolyPaladinToken contract two or more times in a single block including a transaction so it is possible to flash loan assets and pass them to more and more accounts, users can add elements to the delegateCheckpoints array...

Top 3 Attack Trends in API Security – Podcast

In late July 2021, online retailers got hit with a jaw-dropping 2,800 percent increase in attack takeovers. Dead-set on gift card fraud via “scrape for resale” and other types of fraud, the attacks spiraled up to the rate of 700,000 attacks per day. In a separate case – of a loan application frau...

Withdrawal Requests Can Be Bypassed

Lines of code Vulnerability details Impact Withdrawals can be initiated by accounts by calling the initiateWithdrawal function. A block delay is enforced with an expiration to prevent flash loan attacks on the protocol. However, because withdrawal requests are conducted on the account's token...

[WP-H4] anchor_basset_reward pending yields can be stolen

Lines of code Vulnerability details For yield farming aggregators, if the pending yield on an underlying strategy can be harvested and cause a surge of rewards to all existing investors, especially if the harvest can be triggered permissionlessly. Then the attacker can amplify the attack using a...

ERC4626 mints more shares than it should

Lines of code Vulnerability details bug in the mint function of the ERC4626 contract The mint function recieves an amount of shares and an address to and mints the amount of shares to the to address. The sender must transfer an amount of token, so that the ratio will be saved - shares / totalShar...

Flash loan price manipulation in purchasePyroFlan()

Handle sirhashalot Vulnerability details Impact The comment on line 54 of FlanBackstop.sol states "the opportunity for price manipulation through flash loans exists", and I agree that this is a serious risk. While the acceptableHighestPrice variable attempts to limit the maximum price change of t...

anti-flashloan mechanism may lead to protocol default

Handle gzeon Vulnerability details Impact There is a price check to avoid flash loan attacks which significantly moved the price. If current price is 5% lower than the stored twap price, the liquidation will fail. This design can be dangerous as it is to openleverage's benefit to close...

Cooldown and redeem windows can be rendered useless.

Handle ShippooorDAO Vulnerability details Impact Cooldown and redeem windows can be rendered useless. Proof of Concept Given an account that has not staked sNOTE. Account calls sNOTE.startCooldown Account waits for the duration of the cooldown period. Redeem period starts. Account can then deposi...

Scary Fraud Ensues When ID Theft & Usury Collide

Whats worse than finding out that identity thieves took out a 546 percent interest payday loan in your name? How about a 900 percent interest loan? Or how about not learning of the fraudulent loan until it gets handed off to collection agents? One readers nightmare experience spotlights what can...