1625 matches found
Upgraded Q -> M from 964 [1666360503408]
Judge has assessed an item in Issue 964 as Medium risk. The relevant finding follows: Non-critical: EIP712 signatures on GolomTrader could be replayed in case of blockchain forks The chainId is burnt into EIP712DOMAINTYPEHASH rather than checked each time. This means that signatures could be...
Upgraded Q -> M from 921 [1666361310869]
Judge has assessed an item in Issue 921 as Medium risk. The relevant finding follows: 1. Should use call instead of transfer Line References GolomTrader.solL154 Impact The payableaddress.transfer function has a limit of 2300 gas source. If the receiver has a fallback/receive function that require...
Upgraded Q -> M from 42 [1666367610163]
Judge has assessed an item in Issue 42 as Medium risk. The relevant finding follows: Permit signature replay across forks Details: GolomTrader.sol defines chainId at contract deployment without reconstructing it for every signature. However, as stated in the security considerations section of...
Upgraded Q -> M from 266 [1666361934775]
Judge has assessed an item in Issue 266 as Medium risk. The relevant finding follows: Stop Using Transfer Use call instead of transfer, as per. This does not introduce any issues for re-entrancy as all calling functions are marked non-reentrant. --- The text was updated successfully, but these...
Upgraded Q -> M from 796 [1666363133014]
Judge has assessed an item in Issue 796 as Medium risk. The relevant finding follows: L‑01 Use of transferFrom rather than safeTransferFrom for NFTs in will lead to the loss of NFTs The EIP-721 standard says the following about transferFrom: /// @notice Transfer ownership of an NFT -- THE CALLER ...
Upgraded Q -> M from 463 [1666363539691]
Judge has assessed an item in Issue 463 as Medium risk. The relevant finding follows: Ignores return value of onERC721Received The try block should include a check to make sure the function returns its selector as specified by IERC721Receiver. While the function may have the same parameters as th...
Upgraded Q -> M from 330 [1666367006171]
Judge has assessed an item in Issue 330 as Medium risk. The relevant finding follows: GolomTrader is not using ERC721 safeTransferFrom when transferring tokens All the functions that fill orders are not using safeTransferFrom when the owner of the NFT transfer the token to the user or contract th...
Upgraded Q -> M from 612 [1666359673078]
Judge has assessed an item in Issue 612 as Medium risk. The relevant finding follows: NC-01 Replace assembly chainid with Solidity's chainId Description Retrieving the current chain id via the Yul chainid expression can be replaced with the Solidity native call to chainId. Findings...
Upgraded Q -> M from 236 [1666363743332]
Judge has assessed an item in Issue 236 as Medium risk. The relevant finding follows: ERC721 token can be lost in fillAsk PROBLEM When a user fills an ask order by calling fillAsk, the ERC721.transferFrom method is used to transfer the NFT to the receiver. Should the receiver be a smart contract...
Upgraded Q -> M from 100 [1666359995498]
Judge has assessed an item in Issue 100 as Medium risk. The relevant finding follows: L-05 address.callvalue:x should be used instead of payable.transfer:- File: 2022-07-golom/contracts/core/GolomTrader.sol line 154: payablepayAddress.transferpayAmt; --- The text was updated successfully, but the...
Upgraded G -> M from 553 [1666369528441]
Judge has assessed an item in Issue 553 as Medium risk. The relevant finding follows: 01 - payEther use transfer instead of call Replace line 154 for payablepayAddress.callvalue: payAmt"" Reason --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 460 [1666364175291]
Judge has assessed an item in Issue 460 as Medium risk. The relevant finding follows: 7. transfer is used to transfer Ether Description: GolomTrader uses transfer method to send Ether. This is generally less recommended these days see article from Consensys Diligence, mainly because gas costs can...
Upgraded Q -> M from 345 [1665830444380]
Judge has assessed an item in Issue 345 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 220 [1665830289014]
Judge has assessed an item in Issue 220 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 211 [1665775603120]
Judge has assessed an item in Issue 211 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 269 [1665775697646]
Judge has assessed an item in Issue 269 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 160 [1665775526819]
Judge has assessed an item in Issue 160 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 221 [1665738683985]
Judge has assessed an item in Issue 221 as Medium risk. The relevant finding follows: L‑01 Don't use payable.transfer/payable.send The use of payable.transfer is heavily frowned upon because it can lead to the locking of funds. The transfer call requires that the recipient is either an EOA accoun...
[M1] _executeTokenTransfer can succeed without transferring tokens
Lines of code Vulnerability details Impact NFT Tokens may not be transferred in execute PoC During compile time AssetType can be either ERC721 or ERC1155 0 or 1. However, in execution time this value can be more than 1. The internal function executeTokenTransfer will succeed when AssetType 1...