The 'Nouns Fork' is considered unfair towards contributors, given they are not awarded any new tokens.

Lines of code Vulnerability details Impact The 'Nouns Fork' is considered unfair towards contributors, given they are not awarded any new tokens. Proof of Concept The Nouns Fork mechanism allows members of the minority in the Nouns DAO to exit to a new forked Nouns DAO, but the current approach m...

Read-only reentrancy is possible

Lines of code Vulnerability details Impact The agToken might be minted wrongly as rewards due to the reentrancy attack. Proof of Concept There are redeem/swap logics in the transmuter contract and all functions don't have a nonReentrant modifier. So the typical reentrancy attack is possible durin...

the mint function in erc4626 will mint incorrect amount

Lines of code Vulnerability details Impact if you look at the ERC4626 contract the function mint minting the wrong amount at line 53 it should be minting the assets amount not the amount of the share and because the shares and assets are not 1:1 it will lead to unwanted results and different mint...

FlywheelAcummulatedRewards/FlywheelBribeRewards gains are instantaneous and can be frontrun

Lines of code Vulnerability details Impact FlywheelAcummulatedRewards/FlywheelBribeRewards gains are instantaneous and can be frontrun. The user only needs to frontrun the delegate before each incentive is distributed to get the incentive, and there is no way to prevent the user from undelegating...

First user can drain funds from staking contract

Lines of code Vulnerability details Impact If the first user locks an extremely small amount of tokens 1 wei, he can manipulate the reward that is supposed to receive. After locking a small amount, he can unlock it before the second user interacts with the contract. See PoC for more details. Note...

StRSR.cancelUnstake doesn't call _payoutRewards before minting new shares

Lines of code Vulnerability details Impact StRSR.cancelUnstake doesn't call payoutRewards before minting new shares. As result this rewards will be distributed for new staker as well. Proof of Concept If user wants to cancel his withdraw, then he can call StRSR.cancelUnstake and mint new shares...

potential reentrancy attack in _mint and _burn function

Lines of code Vulnerability details Impact potential reentrancy because state changes after minting and burning, should change state first Proof of Concept Tools Used Manual Review Recommended Mitigation Steps follow check-effect-interaction pattern as following: function mintaddress policyholder...

No stale data check on data being read from POR feed

Lines of code Vulnerability details Impact Stale data of exchange rate data being used protocol, resulting in loss in terms of ETHX being minted at stale exchange rate which won't have accounted for new reward Recommended Mitigation Steps Check lastUpdatedAt timestamp and that it is within...

cancelUnstake() doesn't payout rewards first

Lines of code Vulnerability details The new cancelUnstake function allows users to cancel their unstaking, by taking the user's drafts and minting it again. However, since the payoutRewards isn't being called this means that the user would get rewards for the period between the last time...

didPay() front-running

Lines of code Vulnerability details Impact The minting flow of tokens in JBXBuybackDelegate is divided into separate external functions: payParams and didPay. The didPay function can only be called by jbxTerminal, while payParams can be called by anyone without restrictions. The payParams functio...

Malicious user can Mint infinite amount of project tokens as anyone can call payParams function through malicious input and set the _tokenCount .

Lines of code Vulnerability details Impact Malicious user can Mint infinite amount of project tokens as anyone can call payParams function through malicious input and set the tokenCount. The payparams function calculates the tokenCount variable which refers to the amount of token to be minted or...

Improper configuration in JBXBuybackDelegate can cause swaps to fail everytime

Lines of code Vulnerability details Impact Improperly configured direction of swap in JBXBuybackDelegate can cause the calls to swap tokens in Uniswap V3 pool to fail everytime. So if the ideal path is token swap over minting, swaps will fail and new project token will be minted instead Proof of...

Anyone can front-rundidPay calling payParams to grief swaps and mints

Lines of code Vulnerability details Impact The payParams function in the IJBPayDelegate contract does not currently have any form of access control implemented. This could allow a malicious user to manipulate the mintedAmount and reservedRate state variable, which can interfere with the correct...

MALICIOUS USER CAN USE LOCKED ETH OF THE CONTRACT TO MINT HIGHER NUMBER OF TOKENS OR SWAP AND RECIEVE MORE TOKENS THAN HE IS ELIGIBLE

Lines of code Vulnerability details Impact In the JBXBuybackDelegate contract, the terminal token is considered to be ETH as of now according to documentation. Hence both the mint and swap functionality uses the data.amount.value as the ETH amount for new token minting or swapping. In the...

Check if the token of projectId matches the projectToken of the JBXBuybackDelegate

Lines of code Vulnerability details Impact At line 202, the amountReceived returned by the swap function is based on the projectToken defined in JBXBuybackDelegate. This will incorrectly trigger the mint function and because there is no verification of projectToken, it will mistakenly mint...

Contributors will be unable to fund a project if UNISWAP token swapping is recommended over minting in JBXBuybackDelegate data source

Lines of code Vulnerability details Impact A core function of the juice-buyback contract, which is to maximise the project tokens received by the contributor, won't work whenever a swap from Uniswap V3 pool provides more tokens over minting because the transaction will revert. This can cause the...

JBXBuybackDelegate swap pathway always reverts unless slippage is set to 100%

Lines of code Vulnerability details Impact The swap pathway will never work and it will revert due to a validation error unless the user specifies a slippage of 100%. This would be extremely harmful as it would let users be targeted by MEV bots. Proof of Concept This is the pathway to payParams:...

Amount of project token minted to beneficiary by JBXBuybackDelegate._mint function is not checked against an expected minimum number of project tokens to be minted to such beneficiary

Lines of code Vulnerability details Impact Calling the following JBPayoutRedemptionPaymentTerminal31.pay function executes fundingCycle, tokenCount, delegateAllocations, memo = store.recordPaymentFrompayer, bundledAmount, projectId, baseWeightCurrency, beneficiary, memo, metadata. File:...

Minting exposes beneficiaries to unlimited slippage while minting the token out, sending back the token in the terminal.

Lines of code Vulnerability details Impact The amount of tokens minted/assets received when minting can be manipulated to an unlimited extent by manipulating the reserves of the pool. Proof of Concept Here the mint function mints the tokens out to the beneficiary. However the Delegate can't speci...

Always mint 1 wei when _data.preferClaimedTokens is false

Lines of code Vulnerability details Impact File: JBXBuybackDelegate.sol 183 function didPayJBDidPayData calldata data external payable override --skip-- 188 uint256 tokenCount = mintedAmount; 189 mintedAmount = 1; --skip-- 200 if data.preferClaimedTokens --skip-- 206 else 207 mintdata, tokenCount...