Users could receive 0 LPTokens when calling add

Lines of code Vulnerability details Impact The addQuote function in Pair.sol calculates the amount of LPTokens received for the amount of baseTokens and fractionalTokens sent. If LPToken's supply 0 then the min amount of baseTokenShare and fractionaTokenShare is used. When the add function is use...

Any user can block other users from interacting with LPTokens by transferring tiny amounts and resetting their lastInteractedTimestamp

Lines of code Vulnerability details Impact LPTokens in several different contracts have an afterTokenTransfer hook, which updates the last interacted timestamp. Because users can send LPTokens to any other user, this resets their last interacted timestamp which is used for several key actions whi...

bringUnusedETHBackIntoGiantPool in GiantMevAndFeesPool can be used to steal LPTokens

Lines of code Vulnerability details Impact real LPTokens can be transferred out of GiantMevAndFeesPool through fake stakingFundsVaults provided by an attacker. Proof of Concept bringUnusedETHBackIntoGiantPool takes in stakingFundsVaults, oldLPTokens, newLPTokens and rotate amounts from old to new...

batchRotateLPTokens in GiantMevAndFeesPool can be used to steal LPTokens

Lines of code Vulnerability details Impact real LPTokens can be transferred out of GiantMevAndFeesPool through fake stakingFundsVaults provided by an attacker. Proof of Concept batchRotateLPTokens takes in stakingFundsVaults, oldLPTokens, newLPTokens and rotate amounts from old to new tokens. The...