withheld_amt calculation is done after minting frxETHToken tokens

Lines of code Vulnerability details Proof of concept The submit method in frxETHMinter.sol has the following code // Give the sender frxETH frxETHToken.mintermintrecipient, msg.value; // Track the amount of ETH that we are keeping uint256 withheldamt = 0; if withholdRatio != 0 withheldamt =...

Mint legendary gobbler for free

Lines of code Vulnerability details Impact Minting a legendary gobbler does not delete getApproved, thus an owner can approve himself before minting the legendary and later transfer back these ordinary gobblers. mintLegendaryGobbler performs an imitation of burning by setting an owner to address0...

A mistake made by the Minters can result in minting tokens to a wrong address or a zero address.

Lines of code Vulnerability details Impact Tokens can be minted to a wrong address. Proof of Concept The function mintermint is used by the Minters, to mint tokens to the users that successfully used the functions submitAndDeposit, submit and submitAndGive. However there is no check in mintermint...

Limited supply of VariableSupplyERC20Token can be bypassed to mint an infinite amount of tokens

Lines of code Vulnerability details Limited supply of VariableSupplyERC20Token can be bypassed to mint an infinite amount of tokens VariableSupplyERC20Token is defined as A ERC20 token contract that allows minting at will, with limited or unlimited supply. No burning possible In the case of a...

You can give address(0) _mint(), confused with _burn()

Lines of code Vulnerability details Impact You can give address0 mint, confused with burn Proof of Concept For example, the Initialize of AuctionCrowdfund does not determine whether initialContributor is 0, so the address0 can be Mint tokenid. //contracts/crowdfund/AuctionCrowdfund.sol function...

First depositor can break share minting

Lines of code Vulnerability details Impact Users will be unable to deposit their wished amount of tokens. Proof of Concept Similar to this ToB yearn audit, an attacker can mint a very small amount of shares and transfer a large amount of WETH to the contract, inflating the share price and making ...

Malicious pausing the contract

Lines of code Vulnerability details Vulnerability details Description There is a function createAuction in Auction contract. It consist the following logic: /// @dev Creates an auction for the next token function createAuction private // Get the next token available for bidding try token.mint...

ATTACKER COULD PREVENT ANY OTHER USERS FROM MINTING SYNTHETIC TOKENS

Lines of code Vulnerability details An attacker can repeatedly call mint followed by burn after depositing some collateral with deposit. If this is appropriately sized and timed, it can cause the mint call to fail for another user due to the check here that is called during mint here. Every time ...

[NAZ-M2] Centralization Risk with "voter_admin" Has The Ability To mintTo/BurnFrom Any Arbitrary Amount of VOTES

Lines of code Vulnerability details Impact "voteradmin" has the ability to mint/burn any arbitrary amount of VOTES. Creating a centralization risk that allows "voteradmin" to pass or veto any proposal. Proof of Concept 1. Alice submits a proposal that benefits the users at an expense of Mallory's...

No check for nftcollection address leads to the user's loss in NFTDropMarket

Lines of code Vulnerability details Impact There is no check for nftContract address in function createFixedPriceSale of NFTDropMarketFixedPriceSale.sol. The seller can deploy a malicious NFT collection contract, everything is very like the collection produced by NFTCollectionFactory except the...

users could mint NFTs for free

Lines of code Vulnerability details Impact Malicious users could mint NFTs AMAP by the collection saleConfig.limitPerAccount with msg.value == 0 ETH Proof of Concept The malicious users call mintFromFixedPriceSale with 0 ETH. the only check is if msg.value mintCostand there is no check for...

Missing onlyCreator modifier on minting functions

Lines of code Vulnerability details Impact Missing onlyCreator modifier or any access-control to the NFTCollection.sol mint function makes all of the contract's minting functions absolutely open to any user. Proof of Concept All minting functions in the NFTCollection contract: mintAndApprove...

Malicious creator can create different NFT drop collections with NFTs that will be revealed to correspond to same ipfs token URI

Lines of code Vulnerability details Impact The following createNFTDropCollection function with different name, symbol, and nonce can be called to create different NFT drop collections. function createNFTDropCollection string calldata name, string calldata symbol, string calldata baseURI, bytes32...

Lent principal includes lender fee

Lines of code Vulnerability details Impact A community owner is able to lend funds to a project by calling the function Community.lendToProject. Lending requires the lender to pay a lenderFee, a percentage of the fee a lender has to pay to the HomeFi system. However, the current implementation...

Upgraded Q -> M from 9 [1659036743700]

Judge has assessed an item in Issue 9 as Medium risk. The relevant finding follows: Centralized risk The operator address can mint arbitrary amount of tokens. In addition, operator can also burn tokens from third-party accounts. If the private key of the owner or minter address is compromised, th...

NameWrapper: parent can change owner of subnode by minting

Lines of code Vulnerability details Impact HIGH - bypassing PARENTCANNOTCONTROL fuse As discussed in the discord, bypassing fuse is considered high, thus reports as high impact Condition for the parent for this exploit: should be able to unwrap: no CANNOTUNWRAP fuse on the parent Or alternatively...

Distribution of reserved tokens may run out of gas

Lines of code Vulnerability details Impact If there are enough entries in the splits array, the function that distributes the reserved tokens will run out of gas, and the reserved tokens will be un-distributable until the current cycle is over, and the splits are changed. If cycles are long, the...

The reserves accounting breaks when total balances surpas type(int256).max

Lines of code Vulnerability details Reserved tokens do not get minted automatically when a new payment is received. Instead, they must be explicitly distributed during the funding cycle which contains the reserved rate and splits that should be applied. If a funding cycle's reserved rate or split...

Any one can mint penny NFT to take some advantage

Lines of code Vulnerability details Any one can mint penny NFT to take some advantage Impact Some users might be taken advantage of, for those who long call or short put the floortoken, and finnally lead to loss of these users. Proof of Concept There is no control over the floortoken platform,...

Lender.sol amountIn is used as returned for Pendle

Lines of code Vulnerability details uint256 returned; // Add the accumulated fees to the total uint256 fee = calculateFeea; feesu += fee; address memory path = new address; path0 = u; path1 = principal; // Swap on the Pendle Router using the provided market and params returned =...