TokenHelper.sol#L40 : safeTransfer will revert due to insufficient gas.

Lines of code Vulnerability details Impact I am adding as high issue since most of the calling is done using the safeTransfer TokenHelper.solL40 : safeTransfer will revert due to insufficient gas. All the fuctions that are using the safeTransfer could fail due to insufficient gas. I see the...

Removing tiers that weren't added

Lines of code Vulnerability details Vulnerability details Description Function recordRemoveTierIds in the JBTiered721DelegateStore removes the tiers by their ids. Perhaps, there is no check that tier is already added. Please note, the only one require that this function performs: if...

Token balance duplication if from==to

Lines of code Vulnerability details Impact In LBToken.transfer balances of from and to are stored in temporary variables and after the subtration, addition operation the results are written to storage. In the second operation since the original balance is used in the addition operation, if from =...

Internal function declared but not called

Lines of code Vulnerability details Impact JBTiered721Delegate.processPayment is an internal function that overrides JB721Delegate.processPayment, however is not called by any other function or contract. With this, users who make a paid contribution will not mint any tier for beneficiary. Proof o...

Iterations over all tiers in recordMintBestAvailableTier can render system unusable

Lines of code Vulnerability details Impact JBTiered721DelegateStore.recordMintBestAvailableTier potentially iterates over all tiers to find the one with the highest contribution floor that is lower than amount. When there are many tiers, this loop can always run out of gas, which will cause some...

JBTiered721DelegateStore: Incorrect calculation of totalRedemptionWeight

Lines of code Vulnerability details Impact In the totalRedemptionWeight function of the JBTiered721DelegateStore contract, the calculation of the weight in the following code is incorrect, and the result of numberOfReservedTokensOutstandingFor should also be multiplied by...

The beneficiary could be the zero address

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. There is no zero address check for the beneficiary ,therefore it is possible the beneficiary is zero and we lose all the reserves Proof of Concept Provide direct links to all referenced code in GitHub...

Missing modifier allow infinite mint for tier

Lines of code Vulnerability details Impact It seems mintReservesFor function is missing the onlyOwner modifier which means Attacker can call this function to mint any amount of reserved tokens Proof of Concept 1. Observe the mintReservesFor function function...

Permanent lockup of tokens without recovery possible

Lines of code Vulnerability details Impact The callhook for whitelisted contracts adds an additional layer of complexity that can have multiple points of failure. If the execution of L2GraphTokenGateway.finalizeInboundTransfer fails indefinitely, there is currently no way to recover the...

[NAZ-M1] GraphTokenUpgradeable.permit() Should Always Check recoveredAddress != 0

Lines of code Vulnerability details Impact The GraphTokenUpgradeable.permit function ignores the recoveredAddress != 0 check if isApprovedForAllownerrecoveredAddress is true. If a user accidentally set the zero address as the operator, tokens can be stolen by anyone as a wrong signature yield...

Dont check return type

Lines of code Vulnerability details Impact Dont check return type Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Add suitable checks --- The text was updated successfully, but these errors were encountered: 👎 1 trust1995 reacted with thumbs down emoji All reactions 👎 1...

No check for zero address

Lines of code Vulnerability details Impact No check for zero address Proof of Concept Tools Used Recommended Mitigation Steps Add check for zero address for contractAddress inside there is not need to emit event if contract does not exist. --- The text was updated successfully, but these errors...

Lack Of A Safety Mechanism For Deducting Selling Fees

Lines of code Vulnerability details Vulnerability Details The transferFees function of the BlurExchange contract calculates and transfers selling fees to multiple fee receivers as shown in L477 - 478 in code snippet 1. The selling fees would be deducted from the selling price. In other words, a...

The buyer will lose their funds by "gas limit DoS via unbounded operations"

Lines of code Vulnerability details Impact If the buyer invoke execute he will lose their funds by gas limit DoS via unbounded operations Proof of Concept execute == executeFundsTransfer == transferFees In case, execute is called by the buyer ,and the seller set fees.length == 2^256-1 As we see...

Assume that asset type passed from outside is valid

Lines of code Vulnerability details Impact Assume that asset type passed from outside is valid. Proof of Concept Tools Used Code analytics Recommended Mitigation Steps Better way is to case collection address to some interface, use method to obtain type. --- The text was updated successfully, but...

ExecutionDelegate can approve arbitrary calling contract

Lines of code Vulnerability details Impact Owner can steal users' funds and tokens. Proof of Concept The owner of ExecutionDelegate can approve any contract to call it, e.g. a malicious contract which can then drain all funds and tokens approved by users to ExecutionDelegate. Users should only...

Buyers will lose an amount of their funds for only one ERC115 token

Lines of code Vulnerability details Impact By using StandardPolicyERC1155.sol as a matchingPolicy for the order. The buyer will transfer an amount of funds ETH or WETH for 2 or more tokens, but he will receive only 1 token. Proof of Concept in case the buyer has set Input.Order.amount 1. Let’s sa...

Critical matching policy logic is unenforced

Lines of code Vulnerability details Impact Malicious order matching. Proof of Concept When being executed two orders are matched using custom matching policies. Certain checks are critical for every order matching. Currently these checks would have to be implemented in the matching policies...

revokeApproval() only work with WETH

Lines of code Vulnerability details Impact User can invoke execute successfully even if revokedApprovalmsg.sender == true Proof of Concept If buyer did invoke revokeApproval it only block matching the orders if paymentToken == WETH but if the paymentToken == address0 the buyer could invoke execut...

Griefing of execute transaction sender

Lines of code Vulnerability details Description In function execute from BlurExchange contract there is a call of executeTokenTransfer function. The last one contains the following logic: function executeTokenTransfer address collection, address from, address to, uint256 tokenId, uint256 amount,...