Tokens can be stolen through transferTo

Handle @cmichelio Vulnerability details Vulnerability Details I know that it's stated that: VADER, USDV, SYNTHS all employ the transferTo function, which interrogates for tx.origin and skips approvals. The author does not subscribe to the belief that this is dangerous In my opinion, it can be ver...

Wrong slippage protection on Token -> Token trades

Handle @cmichelio Vulnerability details Vulnerability Details The Router.swapWithSynthsWithLimit allows trading token to token and specifying slippage protection. A token to token trade consists of two trades: 1. token to base 2. base to token The slippage protection of the second trade base to...

Anyone can curate pools and steal rewards

Handle @cmichelio Vulnerability details Vulnerability Details The Router.curatePool and replacePool don't have any access restriction. An attacker can get a flash loan of base tokens and replace existing curated pools with their own curated pools. Impact Curated pools determine if a pool receives...

You can vote for proposal already completed

Handle s1m0 Vulnerability details Impact The mapPIDfinalised is set on completeProposal but voteProposal doesn't check it. A malicious user with enough capital and/or together with other people could execute a proposal in his favor e.g. a grant infinitely. Proof of Concept 1 newGrantProposal 2...

A proposal can be cancelled by anyone

Handle s1m0 Vulnerability details Impact A proposal can be cancelled by anyone if only exist another proposal with the same type and hasMinority has 16% votes. Proof of Concept 1 voteProposal assume this vote trigger finalise. finalise set mapPIDfinalisingproposalID = true 2 cancelProposal This...

Interest debt is capped after a year

Handle @cmichelio Vulnerability details Vulnerability Details The Utils.getInterestOwed function computes the interestPayment as: uint256 interestPayment = calcShare timeElapsed, year, getInterestPaymentcollateralAsset, debtAsset ; // Share of the payment over 1 year However, calcShare caps...

Completed proposals can be voted on and executed again

Handle @cmichelio Vulnerability details Vulnerability Details A proposal that is completed has its state reset, including the votes. Users can just vote on it again and it can be executed again. Impact Completed proposals should most likely not be allowed to be voted on / executed again. This cou...

changeDAO should be a two-step process in Vader.sol

Handle 0xRajeev Vulnerability details Impact changeDAO updates DAO address in one-step. If an incorrect address is mistakenly used and voted upon then future administrative access or recovering from this mistake is prevented because onlyDAO modifier is used for changeDAO, which requires msg.sende...

Incorrect operator used in deploySynth() of Pools.sol

Handle 0xRajeev Vulnerability details Impact The deploySynth function in Pools.sol is expected to perform a check on the token parameter to determine that it is neither VADER or USDV before calling Factory’s deploySynth function. However, the require incorrectly uses ‘||’ operator instead of ‘&&’...

Pool functions can be called before initialization in init() of Pools.sol

Handle 0xRajeev Vulnerability details Impact All the external/public functions of Pools.sol can be called by other contracts even before Pools.sol contract is initialized. This can lead to exceptions, state corruption or incorrect accounting in other contracts, which may require redeployment of...

Default slippage value too high

Handle janbro Vulnerability details Summary Default slippage value too high. Risk Rating Medium Vulnerability Details MapleGlobals.sol Line 87: maxSwapSlippage = 1000; // 10 % The default slippage value of 10% is vulnerable to sandwich attackers which would shift larger costs onto stakers and LPs...

Loans of tokens with >18 decimals can result in incorrect collateral calculation

Handle 0xsomeone Vulnerability details Impact It is possible for a user to mislead a Pool Delegate to a seemingly innocuous loan by utilizing a token with more than 18 decimals as collateral and lucrative loan terms. Proof of Concept The final calculation within the collateralRequiredForDrawdown ...

Wrong liquidation logic

Eth address 0x6823636c2462cfdcD8d33fE53fBCD0EdbE2752ad Vulnerability details The belowMaintenanceThreshold function decides if a trader can be liquidated: function belowMaintenanceThresholdCrossMarginAccount storage account internal returns bool uint256 loan = loanInPegaccount, true; uint256...

Users Can Drain Funds From MarginSwap By Making Undercollateralized Borrows If The Price Of A Token Has Moved More Than 10% Since The Last MarginSwap Borrow/Liquidation Involving Accounts Holding That Token.

Handle jvaqa Vulnerability details Users Can Drain Funds From MarginSwap By Making Undercollateralized Borrows If The Price Of A Token Has Moved More Than 10% Since The Last MarginSwap Borrow/Liquidation Involving Accounts Holding That Token. Impact MarginSwap's internal price oracle is only...

Several function have no entry check

Email address [email protected] Handle gpersoon Eth address gpersoon.eth Vulnerability details The following functions have no entry check or a trivial entry check: withdrawHourlyBond Lending.sol closeHourlyBondAccount Lending.sol haircut Lending.sol addDelegateown adress... Admin.sol...

Example finding from form

Email address [email protected] Handle adamavenir Eth address 234234234 Vulnerability details Some details: detailsschmetails Impact Brace for it! Proof of concept proof of concept Tools used I used no tools. Just this form and my BARE HANDS Recommended mitigation steps I would recommend not doing...

Testing findings

Email address [email protected] Handle adamavenir Eth address 13123 Vulnerability details These are the details of this vuln details schmetails Impact Some impact! Proof of concept Check it out. I can PROVE the impact. Tools used I used not tools except this form. Recommended mitigation steps I wou...

testing

Email address [email protected] Handle adamavenir Eth address 23423423r4 Vulnerability details 1 Impact 2 Proof of concept 3 Tools used 4 Recommended mitigation steps 5 --- The text was updated successfully, but these errors were encountered: All reactions...

One more test.....

Email address [email protected] Handle adamvenir Eth address 23423423423423432 Vulnerability details 1 Impact 2 Proof of concept 3 Tools used 4 Recommended mitigation steps 5 --- The text was updated successfully, but these errors were encountered: All reactions...

Something else testing here

Email address [email protected] Handle adamavenir Eth address 234234234 Vulnerability details 1 Impact 2 Proof of concept 2 Tools used 4 Recommended mitigation steps 5 --- The text was updated successfully, but these errors were encountered: All reactions...