Optimistic bridging pattern, can lead to bridge exploitation

Lines of code Vulnerability details Impact Zero deposit Bridging. Wherease users can fake the depositing process but can mint multiple tokens in the destination chain. The bridging is optimistic, whereas the validation restricts to just checking the function selector and a no-error pattern, this...

Pseudo randomness is not recommended

Lines of code Vulnerability details Impact Use of pseudo randomness in chain is not recommended as it can be predicted by anyone, this can affect value in case of minting or withdrawing in some scenarios Proof of Concept Tools Used Recommended Mitigation Steps Use oracles --- The text was updated...

Deactivated tiers can still mint reserve tokens, even if no non-reserve tokens were minted.

Lines of code Vulnerability details Description Tiers in Juicebox can be deactivated using the adjustTiers function. It makes sense that reserve tokens may be minted in deactivated tiers, in order to be consistent with already minted tokens. However, the code allows the first reserve token to be...

Beneficiary credit balance can unwillingly be used to mint low tier NFT

Lines of code Vulnerability details Impact In the function processPayment, it will use provided JBDidPayData from JBPaymentTerminal to mint to the beneficiary. The value from JBDidPayData will be sum up with previous credits balance of beneficiary. There are 2 cases that beneficiary credit balanc...

Minting and redeeming will break for fully minted tiers with reserveRate != 0 and reserveRate/MaxReserveRate tokens burned

Lines of code Vulnerability details Impact Minting and redeeming become impossible Proof of Concept uint256 numberOfNonReservesMinted = storedTier.initialQuantity - storedTier.remainingQuantity - reserveTokensMinted; uint256 numerator = uint256numberOfNonReservesMinted storedTier.reservedRate;...

The tier setting parameter are unsafely downcasted from type uint256 to type uint80 / uint48 / uint40 / uint16

Lines of code Vulnerability details Impact The tier setting parameter are unsafely downcasted from uint256 to uint80 / uint48 / uint16 the tier is setted by owner is crucial because the parameter affect how nft is minted. the the callstack is JBTiered721Delegate.solinitialize - StorerecordAddTier...

User can mint more NFT than initial supply because of improper check of _storedTier.remainingQuantity in /JBTiered721DelegateStore#recordMint

Lines of code Vulnerability details Impact User can mint more NFT initial supply because of inproper check of storedTier.remainingQuantity For example, the owner can set the initial amount to 3, but 6 NFT can be minted. when the mintFor is called, the function calls JBTiered721DelegateStore.sol t...

Compromised Arbitrum: No Sanity/Security Checks on Amount in finalizeInboundTransfer() on Layer 2

Lines of code Vulnerability details Description / Proof of Concept If L2GraphTokenGateway.finalizeInboundTransfer receives a valid transaction from the bridge, it will immediately mint any amount of GRT tokens on Arbitrum. Impact This exposes an unnecessarily large attack surface as any compromis...

[NAZ-M2] MINTER_ROLE Can Be Granted By The Deployer and Can Mint Arbitrary Amount of Tokens

Lines of code Vulnerability details Impact If the private key of the deployer or an address with the MINTER is compromised, the attacker will be able to mint an unlimited amount of tokens. I believe this is unnecessary and poses a serious centralization risk. Tools Used Manual Review Recommended...

Governor can rug all GRT by setting the gateway to her wallet (Governor may be hacked)

Lines of code Vulnerability details Impact Governor can rug all GRT by setting the gateway to her wallet Governor may be hacked. Proof of Concept First, the Governor set the gateway contract to her wallet function setGatewayaddress gw external onlyGovernor requiregw != address0, "INVALIDGATEWAY";...

Missing zero value check in AlgebraPool.initialize() would cause reverts preventing minting and swapping.

Lines of code Vulnerability details Impact The initialize function in AlgebraPool contract sets the globalState price and tick for the Algebra Pool. However, due to a missing check to ensure the price is not set to zero, a revert would occur always when calculating amounts for liquidity in...

The users can steal the pages from the community reserve

Lines of code Vulnerability details Impact community reserve could be losing some pages Proof of Concept In case mintCommunityPages start minting let's say 20 pages if Alice has invoke mintFromGoo before this looop for uint256 i = 0; i numPages; i++ mintcommunity, ++lastMintedPageId; Has finished...

The users can steal the Gobbler from the team

Lines of code Vulnerability details Impact In case mintReservedGobblers start minting let's say 20 for team + 20 for community And the loop on batchMint is now i == 3 Now Alice will invoke mintFromGoo to mint one Gobbler he will steal this Gobbler from the team address Proof of Concept Let’s say...

Gobblers burnt for minting legendary Gobblers can be transferred out from the address zero

Lines of code Vulnerability details Impact The mintLegendaryGobbler function burn standard gobblers by setting their owner to address0 without deleting the getApprovedid. So the original owner can setApproval for himself address and transfer the gobbler token back to any address from the address0...

Allowance isn't deleted when burning gobblers in mintLegendaryGobbler()

Lines of code Vulnerability details Impact Legendary gobblers can be minted for free. Proof of Concept A simple attack allows anyone with enough gobblers to pay for a legendary to get it for free Step by step attack : -Attacker has 69 gobblers and gives approval of all of them to himself -Attacke...

The LegendaryGobbler can has emissionMultiple == 0

Lines of code Vulnerability details Impact The user could mint LegendaryGobbler with emissionMultiple == 0 Proof of Concept On legendaryGobblerPrice In case this check executed if numMintedSinceStart = LEGENDARYAUCTIONINTERVAL return 0; The cost on mintLegendaryGobbler will be cost == 0 That mean...

Forgetting to delete approval can help attacker mint any legendary gobbler with 0 cost of standard gobblers

Lines of code Vulnerability details 2022-09-artgobblers Forgetting to delete approval can help attacker mint any legendary gobbler with 0 cost of standard gobblers. tags: c4, 2022-09-artgobblers, high Affected code Impact When mint new lengendary gobbler, an amount of standard gobblers cost must ...

Users can regain gobblers they use to mint Legendary Gobbler with.

Lines of code Vulnerability details Impact Users can mint legendary gobblers without actually burning their gobblers by using the GobblersERC721.approve function to approve themselves before minting their legendary gobbler the burn mechanism, doesn't delete the getApproved approved entry for that...

Wrong balanceOf user after minting legendary gobbler

Lines of code Vulnerability details Impact In ArtGobblers.mintLegendaryGobbler function, line 458 calculates the number of gobblers user owned after minting // We subtract the amount of gobblers burned, and then add 1 to factor in the new legendary. getUserDatamsg.sender.gobblersOwned =...

Can Recover Gobblers Burnt In Legendary Mint

Lines of code Vulnerability details Impact Allows users to mint legendary Gobblers for free assuming they have the necessary amount of Gobblers to begin with. This is achieved by "reviving" sacrificed Gobblers after having called mintLegendaryGobbler. Severity Justification This vulnerability...