mintSynth() can transfer funds from an arbitrary address

Handle Critical Vulnerability details Impact Attackers can steal funds from users' balances for those who approved the VaderPoolV2 contract. Proof of Concept nativeAsset.safeTransferFromfrom, addressthis, nativeDeposit; VaderPoolV2.mintSynth allows anyone to transfer funds from an arbitrary addre...

Griefing attack is possible as NFTXStakingZap, PalmNFTXStakingZap, NFTXMarketplaceZap rely on zero vault token balance for LP and minting

Handle hyh Vulnerability details Impact NFTXStakingZap and PalmNFTXStakingZap liquidity provision and NFTXMarketplaceZap minting will be blocked as addLiquidity and mint functions will revert all the time. An attacker can transfer a tiny amount of vault tokens to NFTXStakingZap/PalmNFTXStakingZap...

wrong withdraw

Handle certora Vulnerability details the comment says that the function should byrn user shares, but it also mints them. in addition, that function transfers tokens from msg.sender to addressthis, but it should be upside down. --- The text was updated successfully, but these errors were...

It is possible to "uninitialize" ERC20Facet contract

Handle Czar102 Vulnerability details Impact The initialization status is defined by the name and symbol. It is possible it set them back to an empty string, uninitializing the contract and letting the initialize.. function be called again. This way, the owner may, for example, hide minting...

Token mint without transfer

Handle csanuragjain Vulnerability details Impact User will be minted token without transferring any amount Proof of Concept 1. Owner has removed all tokens from the basket using removeToken function. So bs.tokens.length=0 2. User joins the pool using joinPool function. Now below happens: a. Since...

Wrong fee calculation after totalSupply was 0

Handle kenzo Vulnerability details handleFees does not update lastFee if startSupply == 0. This means that wrongly, extra fee tokens would be minted once the basket is resupplied and handleFees is called again. Impact Loss of user funds. The extra minting of fee tokens comes on the expense of the...

Wrong implementation of performanceFee can cause users to lose 50% to 100% of their funds

Handle WatchPug Vulnerability details A certain amount of lp tokens shares of the vault will be minted to the strategyPerformanceTreasury as performanceFee, the amount is calculated based on the minLpPriceFactor. However, the current formula for toMint is wrong, which issues more than 100% of the...

Users can avoid paying vault fees

Handle cmichel Vulnerability details The LPIssuer.deposit/withdraw function charges protocol&management&performance fees through inflating the LP supply in the chargeFees function. However, this LP fees minting is skipped if the elapsed time is less than the managementFeeChargeDelay: if elapsed...

Referrer discount token amount can be manipulated

Handle cmichel Vulnerability details The Unlock.recordKeyPurchase function is called on each key purchase MixinPurchase.purchase and mints UDT tokens to the referrer. The amount to mint is based on the transaction's gas price which is controlled by the caller purchaser: uint tokensToDistribute =...

Missing maxNumberOfKeys checks in shareKey and grantKey

Handle kenzo Vulnerability details More keys can be minted than maxNumberOfKeys since shareKey and grantKey do not check if the lock is sold out. Impact More keys can be minted than intended. Proof of Concept In both shareKey and grantKey, if minting a new token, a new token is simply minted and...

_transferMint not incrementing totalSupply of OVL after minting

Handle hubble Vulnerability details Impact The function transferMint is called by both transferFromMint and transferMint which again is used while issuing shares when a user takes a position in OI. Proof of Concept File : ovl/OverlayToken.sol file line 268 : function transferMint address sender,...

borrowFee can be completly bypassed while minting

Handle hack3r-0m Vulnerability details uint256 totalCredit = cdp.totalCredit; retrieves total credit of caller if totalCredit amount // user pays the fee ... else cdp.totalCredit = totalCredit.subamount; here amount is caller amount and = totalCredit then the user can skip paying fees everytime...

onPriceCheck revert on every transaction

Handle jonah1005 Vulnerability details Impact onPriceCheck in the Alchemist.sol does not implement correctly. modifier onPriceCheck if pegMinimum 0 require ICurveTokenaddresstoken.getvirtualprice pegMinimum, 'off peg limitation' ; ; There's no getvirtualprice in stable coin contracts. There's no...

Prevent Minting During Emergency Exit

Handle TimmyToes Vulnerability details Impact Potential increased financial loss during security incident. Proof of Concept Consider a critical incident where a vault is being drained or in danger of being drained due to a vulnerability within the vault or its strategies. At this stage, you want ...

A user allowed to mint AlToken can mint an unlimited amount of it

Handle 0x0x0x Vulnerability details Impact A user with permission of minting can mint unlimited tokens. Proof of Concept We assume the user is allowed to mint, so the user is whitelisted, not blacklisted and ceilingmsg.sender 0. Furthermore, we assume that the contract is not paused. So when a us...

ERC1155Supply vulnerability in OpenZeppelin Contracts

Handle defsec Vulnerability details Impact When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the ERC1155Supply extension, total supply is not updated until after the callback, thus during the callback the reported total...

Missing _token.approve() to curvePool in setZapConfig

Handle WatchPug Vulnerability details function setZapConfig uint256 idx, address sett, address token, address curvePool, address withdrawToken, int128 withdrawTokenIndex external onlyGovernance; requiresett != address0; requiretoken != address0; require withdrawToken == addressWBTC || withdrawTok...

VaderPoolV2 minting synths & fungibles can be frontrun

Handle cmichel Vulnerability details The VaderPoolV2 mintFungible and mintSynth functions perform an unsafe nativeAsset.safeTransferFromfrom, addressthis, nativeDeposit with a parameter-specified from address. Note that these functions are not called by the Router, they are directly called on the...

Lack of access control allow attacker to mintFungible() and mintSynth() with other user's wallet balance

Handle WatchPug Vulnerability details function mintFungible IERC20 foreignAsset, uint256 nativeDeposit, uint256 foreignDeposit, address from, address to external override nonReentrant returns uint256 liquidity IERC20Extended lp = wrapper.tokensforeignAsset; require lp != IERC20ExtendedZEROADDRESS...

Mixing different types of LP shares can lead to losses for Synth holders

Handle hyh Vulnerability details Impact Users that mint Synths do not get pool shares, so exiting of normal LP can lead to their losses as no funds can be left for retrieval. Proof of Concept 3 types of mint/burn: NFT, Fungible and Synths. Synths are most vilnerable as they do not have share: LP...