Minter and position privileges allow unrestricted minting and burning of arbitrary tokens

Lines of code Vulnerability details Any registered minter and a position belonging to him have absolute control of minting and burning tokens on all accounts. Impact New minting mechanisms are subject to governance approval i.e. can be veto’ed. These, however, will be arbitrary contracts with...

Positions can be created to mint unlimited tokens and still run off with the provided collateral.

Lines of code Vulnerability details Impact Brief Introduction A compromised position can be used to mint tokens up to the limit. The attacker can also withdraw this collateral. Hence, the attacker can mint tokens against his collateral and withdraw his collateral at the same time. Explanation...

Unrestricted Token Transfer and Minting

Lines of code Vulnerability details Impact An attacker could exploit this vulnerability to mint an unlimited number of tokens, potentially devaluing the token and manipulating the market. Proof of Concept: Proof of Concept --The contract allows anyone to call the onTokenTransfer function without...

Anyone can open any position with no init period

Lines of code Vulnerability details Impact Anyone can immediately open a malicious position by calling openPosition... and passing 0 as initPeriodSeconds. Proof of Concept The function on line has public visibility, whereas I suspect it should be private. This effectively means anyone can mint an...

The owner of position can mint zchf unlimitedly by becoming the challenger that successfully challenges their own position to receive unlimit reward.

Lines of code Vulnerability details Summary The owner of position can become the challenger of his position and end the challenge within the same block after the open the position to earn unlimited reward. By executing within the same block, the owner could prevent the intervention of other...

An attacker can mint himself many tokens for free by cloning a position and adjusting its price

Lines of code Vulnerability details Impact A malicious attacker can mint himself the max limit amount of tokens of any position for free, by cloning a position and manipulating its price. Proof of Concept Steps overview: 1. a The attacker clones an existing position 2. b The attacker sets the pri...

Lack of validation in opening positions parameters can lead to critical vulnerabilities at protocol level

Lines of code Vulnerability details Suspicious positions may be denied by voters if they don't seem legit, but over time it is very possible that one of them lands in the protocol, which can involve serious risks. Some attributes may not seem harmful with certain values at first sight, and can le...

User minting FPS can get grieved by equity loss event

Lines of code Vulnerability details minting in onTokenTransfer handles the case equity = MINIMUMEQUITY, "insuf equity"; // ensures that the initial deposit is at least 1000 ZCHF 245: 246: // Assign 1000 FPS for the initial deposit, calculate the amount otherwise 247: uint256 shares = equity =...

ReraiseETHCrowdfund#claimMultiple can be used to grief large depositors

Lines of code Vulnerability details Impact User can be grieved by being force minted a large number of NFTs with low voting power instead of one with high voting power Proof of Concept ReraiseETHCrowdfund.solL354-L377 for uint256 i; i maxContribution revert...

Use of _mint in ReraiseETHCrowdfund#_contribute is incompatible with PartyGovernanceNFT#mint

Lines of code Vulnerability details Impact Misconfigured receiver could accidentally DOS party Proof of Concept ReraiseETHCrowdfund.solL238 if previousVotingPower == 0 mintcontributor; - @audit-issue standard minting here ReraiseETHCrowdfund.solL374 uint256 tokenId = party.mintcontributor,...

Possible DOS attack using dust in ReraiseETHCrowdfund._contribute()

Lines of code Vulnerability details Impact Normal contributors wouldn't contribute to the crowdfund properly by a malicious frontrunner. Proof of Concept When users contribute to the ReraiseETHCrowdfund, it mints the crowdfund NFT in contribute. File:...

In stake() function shares increase exponentially for the same amount of deposit as the totalSupply() increases, causing the loss for the initial stakers relative to later ones.

Lines of code Vulnerability details Impact Stake function don not allocate the safEth according to the totalShares, instead as more user deposit, later depositers get higher share of the value as compared to ealy depositers. Proof of Concept Consider Alice, Bob and Jenny want to stake their eth...

An attacker can manipulate the preDepositvePrice to steal from other users.

Lines of code Vulnerability details Impact The first user that stakes can manipulate the total supply of sfTokens and by doing so create a rounding error for each subsequent user. In the worst case, an attacker can steal all the funds of the next user. Proof of Concept When the first user enters...

sfrxETH.ethPerDerivative is incorrect, leading to incorrect minting amount of safETH

Lines of code Vulnerability details SafeETH.stake allows users to stake ETH and be minted an amount of safETH that corresponds to the ETH value of the derivatives that resulted from their deposit. The minting amount is based on: preDepositPrice, which is a function of the total safETH minted and...

[H-01] RETH oracle manipulation allows attacker to steal funds

Lines of code Vulnerability details Impact The Asymmetry SafEth protocol aims to help diversify and decentralize liquid staking derivatives, exchanging ether staked in the protocol for staked ether derivative tokens based on some relative weighting. A function exposed by these derivative wrapper...

Multiple Mint of PFP with same NFTID

Lines of code Vulnerability details Impact Malicious user having only one NFT can mint PFP severally. Hence one user with only one NFT but multiple PFP. This isn't the intended implementation. Proof of Concept Is self-understandable. POC not required Recommended Mitigation Steps storing used NFT'...

[H-3] Any account can mint or burn an unlimited number of vault tokens and drain the Kangaroo Vault.

Lines of code Vulnerability details Impact This is a failure in setting up access control. Anyone could set the vault address to their address and call the mint/burn function to mint and burn vault tokens. The impact is severe since all the funds in Kangaroo vault can be withdrawn by anyone. Proo...

Users can lose funds due to stuck NFT's

Lines of code Vulnerability details Impact If msg.sender is a contract could also be smart contract wallet that does not implement the onERC721Received method, in the current implementation of fuse Namespace.sol && mint Bio.sol, the tx will still be successful, and the token will be minted. In th...

Owner is able to mint 1 token more than 1000 prelaunch tokens due to wrong equality check

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Owner is able to mint 1 token more than 1000 prelaunch tokens due to wrong check here Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant...

No access control in mint function

Lines of code Vulnerability details Impact Canto Bio Protocol: Should allow the association of a single biography to an identity address The mint function does not have any access control mechanism in place, allowing anyone to mint multiple Bio NFTs. This could lead unwanted minting of bios. Tool...