OpenLevV1Lib's and LPool's doTransferOut functions call native payable.transfer, which can be unusable for smart contract calls

Handle hyh Vulnerability details Impact When OpenLev operations use a wrapped native token, the whole user withdraw is being handled with a payable.transfer call. This is unsafe as transfer has hard coded gas budget and can fail when the user is a smart contract. This way any programmatical usage...

The wrap and unwrap functions lack access control, allowing anyone to consume the convexToken in the contract

Handle cccz Vulnerability details Impact In the wrap and unwrap functions of the ConvexYieldWrapper contract, due to the lack of access control, anyone can consume the convexToken in the contract function wrapaddress to, address from external require!isShutdown, "shutdown"; uint256 amount =...

transferFrom can return false, and didnt revert

Handle Tomio Vulnerability details Impact in the the user can create launchevent, and providing token to the launchevent contract, however, some token may behave differently when handling a failed transfer and transferFrom, some token may handle failed transfer and transferFrom by returning a fal...

Unchecked transfers may lead to funds lost.

Handle bobi Vulnerability details Impact There are some transferFrom and transfer calls without checking the resultseg. against reverting. Moreover, for certain ERC20 tokens, should insufficient tokens be present, no revert occurs whatsoever, and instead, a "false" value is returned, which should...

Unchecked token transfers are used in LaunchEvent and RocketJoeFactory

Handle hyh Vulnerability details Impact For some ERC20 tokens no revert occurs but false is returned if transfer failed for any reason. If this isn't checked, the system will enter a wrong state with an accounted, but not executed transfer. This effect can pile up, messing the logic altogether...

Lack of input checks (withrawal penalties should always be greater than 0)

Handle pedroais Vulnerability details Impact If penalties are set to 0 the protocol would be vulnerable to price manipulations like the one described in the contest documentation. Proof of Concept The protocol uses economic penalties to punish withdraws to protect against economic price...

Sherlock: arbRestake() doesnt reduce addressShares of owner

Handle GreyArt Vulnerability details Impact As per the documentation, “After 2 weeks without action on an unlocked position arbs can come in to arbRestakeid, 20% of the underlying USDC amount principal + yield is at risk for the owner of the position.” While shares are redeemed for the arbitrager...

Owner can set arbitrary premium which allow nonStakers drain funds

Handle wuwe1 Vulnerability details Impact Owner can set arbitrary premium, this will cause protocol lose all the activeBalance, stakers lose all the claimable premium and nonStakers can drain all the usdc. Proof of Concept setProtocolPremium does not check the value of premium. premium can be...

transferTokenOut does not restrict withdraw to requested amount of token

Handle samruna Vulnerability details function transferTokensOutaddress receiver, uint256 amount internal // Transfers any premiums owed to stakers from the protocol manager to this contract sherlockProtocolManager.claimPremiumsForStakers; // The amount of tokens in this contract uint256 mainBalan...

Fund loss when insufficient call value to cover fee

Handle gzeon Vulnerability details Impact Fund can be lost if the L1 call value provided is insufficient to cover maxSubmissionCost, or stuck if insufficient to cover maxSubmissionCost + maxGas gasPriceBid. Proof of Concept outboundTransfer in L1LPTGateway does not check if the call value is...

Duplicate total in getMigrateUnbondingLocksParams

Handle 0x1f8b Vulnerability details Impact Wrong total computation. Proof of Concept The method getMigrateUnbondingLocksParams inside the contract L1Migrator doesn't check that the array unbondingLockIds provided by the user has duplicate ids, if the user provide duplicate ids the total will be...

Unbounded iteration over all indexes (2)

Handle Dravee Vulnerability details Impact The transactions could fail if the array get too big and the transaction would consume more gas than the block limit. This will then result in a denial of service for the desired functionality and break core functionality. Proof of Concept Tools Used VS...

Looping over dynamic array might result in DoS through the block gas limit

Handle Ruhum Vulnerability details Impact Because of the block gas limit, looping over a dynamic array that grows over time might result in a DoS at some point. Both the PoolTemplate and the IndexTemplate have such dynamic arrays. Both don't have any functionality to decrease the size. Meaning, i...

Expired insurance status set incorrectly after unlock of funds

Handle ye0lde Vulnerability details Impact Expired insurance status set incorrectly after unlock of funds The insurance status is not set to false and the unlock function can be called over and over driving the lockedAmount to 0. The distorted lockedAmount will then cause liquidity and utilizatio...

System Debt Is Not Handled When Insurance Pools Become Insolvent

Handle leastwood Vulnerability details Impact If an incident has occurred where an insurance policy is to be redeemed. The market is put into the MarketStatus.Payingout mode where the insurance.insured account is allowed to redeem their cover and receive a payout amount. Upon paying out the...

Incompatibility With Rebasing/Deflationary/Inflationary tokens

Handle defsec Vulnerability details Impact The Strategy contracts do not appear to support rebasing/deflationary/inflationary tokens whose balance changes during transfers or over time. The necessary checks include at least verifying the amount of tokens transferred to contracts before and after...

Missing Re-entrancy Guard

Handle defsec Vulnerability details Impact The re-entrancy guard is missing on the Eth anchor interaction. The external router interaction can cause to the re-entrancy vulnerability. Proof of Concept 1. Navigate to the following contract. function finishDepositStableuint256 idx external...

Unsafe mint is a reentrancy door

Handle pedroais Vulnerability details Impact Dangerous external calls in the middle of various state changes could cause reentrancy issues since there is no reentrancy guard in any functions. Proof of Concept When users call the deposit or sponsor functions a deposit NFT is minted. The safeMint...

Typo in PoolTemplate unlock function results in user being able to unlock multiple times

Handle loop Vulnerability details The function unlock in PoolTemplate has a typo where it compares insurancesid.status to false rather than setting it to false. If the conditions are met to unlock the funds for an id, the user should be able to call the unlock function once for that id as...

A Single Malicious Trusted Account Can Takeover Parent Contract

Handle leastwood Vulnerability details Impact The requiresTrust modifier is used on the strategy, vault and factory contracts to prevent unauthorised accounts from calling restricted functions. Once an account is considered trusted, they are allowed to add and remove accounts by calling...