PostAuctionLauncher's liquidity provision can be exploited

Handle cmichel Vulnerability details The PostAuctionLauncher.finalize function takes the raised payment token amounts and uses previously provided auction token amounts to provide liquidity to a Sushiswap pool after an auction has successfully been finalized. It provides this liquidity at a...

Reordering of strategies on Controller does not reorder strategies in Harvester

Handle itsmeSTYJ Vulnerability details Impact The harvester might harvest the wrong strategy because the array of strategies that it stored in its storage is not in the same order as the one stored in the controller. Recommended Mitigation Steps Add a similar reorder strategy function in...

earn results in decreasing share price

Handle jonah1005 Vulnerability details Impact For a dai vault that pairs with NativeStrategyCurve3Crv, every time earn is called, shareholders would lose money. about 2% There're two issues involved. The Vault contract and the controller contract doesn't handle the price difference between the wa...

Vault treats all tokens exactly the same that creates (huge) arbitrage opportunities.

Handle jonah1005 Vulnerability details Impact The v3 vault treats all valid tokens exactly the same. Depositing 1M DAI would get the same share as depositing 1M USDT. User can withdraw their share in another token. Though there's withdrawalProtectionFee 0.1 percent, the vault is still a no slippa...

Cannot actually submit evidence

Handle jmak Vulnerability details Impact Detailed description of the impact of this finding. The SubmitBadSignatureEvidence is not actually registered in the handler and hence no one can actually submit this message, rendering the message useless. This harms the security model of Gravity since...

logic calls can steal tokens

Handle 0xito Vulnerability details Impact attacker can send a logic call that performs a token.approveattackerAddress, typeuint256.max using the submitLogicCall function. afterwards, they can steal all tokens from the bridge using token.safetransferfrombridge, attacker, amount. Proof of Concept...

veCVXStrategy.manualRebalance has wrong logic

Handle cmichel Vulnerability details Vulnerability Details The veCVXStrategy.manualRebalance function computes two ratios currentLockRatio and newLockRatio and compares them. However, these ratios compute different things and are not comparable: currentLockRatio =...

Possible miner incentive for chain reorgs if ETHBlockDelay is too small

Handle tensors Vulnerability details Impact If ETHBlockDelay is too small and the incentive for miners is large enough, it would profitable for miners to attempt to double spend by depositing assets, waiting for confirmation on the cosmos-SDK and then reorging the blockchain. Although an attack...

Owner has a rugpull function

Handle tensors Vulnerability details Impact The owner of the contract has a rugpull function. This can be unsafe if the private key for the owner account falls into the wrong hands, allowing instant withdrawal of all the funds. In general, having a single point of failure like this is not...

Parameter updates not propagated

Handle gpersoon Vulnerability details Impact There are several functions to update parameters. However these parameters are only updated on the top level and not propagated to the other contracts. This could lead to various unpredictable results. Examples are: setNftHubAddress of RCFactory...

Rewards squatting - setting rewards in different ERC20 tokens opens various economic attacks.

Handle moose-code Vulnerability details Impact Users have essentially have an option to either claim currently earned reward amounts on future rewards tokens, or the current rewards token. Although stated on line 84, it does not take into account the implications and lock in this contract will ha...

ERC20Rewards breaks when setting a different token

Handle cmichel Vulnerability details The setRewards function allows setting a different token. Holders of a previous reward period cannot all be paid out and will receive their old reward amount in the new token. This leads to issues when the new token is more less valuable, or uses different...

Potential for market to be created but never initialized

Handle loop Vulnerability details Impact Multiple markets can be created before being initialized since createNewSyntheticMarket and initializeMarket are separate functions. The SyntheticTokens used in initialization will however always be those of the latest market created. Proof of Concept Let'...

2 variables not indexed by marketIndex

Handle gpersoon Vulnerability details Impact In the token contract: batchedstakerNextTokenShiftIndex is indexed by marketIndex, so it can have separate or the same values for each different marketIndex. stakerTokenShiftIndextolongShortMarketPriceSnapshotIndexmapping and...

Staker.sol: Wrong values returned in edge cases of _calculateFloatPerSecond()

Handle hickuphh3 Vulnerability details Impact In calculateFloatPerSecond, the edge cases where full rewards go to either the long or short token returns return 1e18 k longPrice, 0; and return 0, 1e18 k shortPrice; respectively. This is however 1e18 times too large. We can verify this by checking...

SwappableYieldSource: Missing same deposit token check in transferFunds()

Handle hickuphh3 Vulnerability details Impact transferFunds will transfer funds from a specified yield source yieldSource to the current yield source set in the contract currentYieldSource. However, it fails to check that the deposit tokens are the same. If the specified yield source's assets are...

Inconsistent balance when supplying transfer-on-fee or deflationary tokens

Handle shw Vulnerability details Impact The supplyTokenTo function of SwappableYieldSource assumes that amount of depositToken is transferred to itself after calling the safeTransferFrom function and thus it supplies amount of token to the yield source. However, this may not be true if the...

[Gov.sol] Ignoring the return value of function _token.approve(...)

Handle eriksal1217 Vulnerability details Impact Medium Risk vulnerability - This does not immediately affect the contract, tokens, or funds associated but could have negative effects in regards to how the contract behaves when executing this functionality. Proof of Concept According to Slither...

Allowance cannot be reset once it is set to the maximum

Handle shw Vulnerability details Impact The approve functions of the pool LP tokens and synths do nothing if the allowances is already the maximum number, i.e., typeuint256.max. Therefore, Alice cannot change her allowance to Bob once she approved him with the maximum approval. Proof of Concept...

Swap fees are not accounted for if users swap directly from the pools

Handle shw Vulnerability details Impact The Pool calculates swap fees whenever there is a swap between the SPARTA and the TOKEN or synths. The Router uses this fee value to decide the amount of dividend transferred from the Reserve to the Pool. However, if a user performs the swap by directly...