Founders may not receive their vesting allocations

Lines of code Vulnerability details Impact In addFounders the vesting allocations are distributed among the first one hundred nouns according to their ownership percentage. These first one hundred represent the token ID:s modulo 100 that should be minted to the nounders, which is how it is...

Adversary can gain Infinite voting power due to integer overflow

Lines of code Vulnerability details Impact Specifically, ERC721Votes enables users to delegate their voting power to others. Note that when delegating the voting power, the actual token balance will not change. On the other hand, when transferring tokens, the voting power transfers accordingly:...

Users retain votes from their delegated tokens

Lines of code Vulnerability details Impact When a user has undelegated tokens and delegates them to another user, the owner retains all votes for their tokens, while the delegatee also gains those votes. By chaining this attack together, this could allow a user to generate unlimited votes, taking...

External Calls inside loops of _multiRedeem & redeem function may cause Denial of Service

Lines of code Vulnerability details Impact Calls inside loops that may address DoS. Proof of Concept Calls to external contracts inside a loop are dangerous especially if the loop index can be user-controlled because it could lead to DoS if one of the calls reverts or execution runs out of gas...

DoS with (Unexpected) revert or Gas Limit DoS on a Contract via Unbounded Operations

Lines of code Vulnerability details Impact According to SWC-113, external calls can fail accidentally or deliberately, which can cause a DoS condition in the contract. To minimize the damage caused by such failures, it is better to isolate each external call into its own transaction that can be...

Deniel of service with block gas limit.

Lines of code Vulnerability details Impact An array of unknown size can lead to Deniel of service with block gas limit. Proof of Concept When smart contracts are deployed or functions inside them are called, the execution of these actions always requires a certain amount of gas, based of how much...

Calls inside loops that may address DoS/Griefing

Lines of code Vulnerability details Calls inside loops that may address DoS/Griefing Description Calls to external contracts inside a loop are dangerous especially if the loop index can be user-controlled because it could lead to DoS if one of the calls reverts or execution runs out of gas...

It can be Underflow

Lines of code Vulnerability details 🎨 Category Data Validation 💥 Impact If amountIn is greater than redeemBase, this happens underflow and reverting the transaction. 📝 Proof of Concept The value of amountIn can set by users so It can be underflow. e.g redeemBase = 5 redeemaddresstest, 10 This...

Loss of precision will lock portions of tokens

Lines of code Vulnerability details Impact When the initial balance of a redemption reward token is smaller than the base, small amounts of the token will be rounded down to zero, meaning small-amount users will get nothing for redeeming tokens. Broken accounting means high severity Proof of...

Function getRedeemAmountOut can't deliver was it should be

Lines of code Vulnerability details Proof of Concept The fn of getRedeemAmountOut can't be deliver the same as it should be eversince it has @params uint256 amountIn and return amountIn which clearly should be amountFeiIn. So the calculate would be deliver wrong value. Tools Used Manual Review...

The mint function is missing the minAmountOut control, this will cause the user to lose their funds.

Lines of code Vulnerability details Impact The mint function of the SimpleFeiDaiPSM contract receives DAI from the user, mints the FEI and sends it to the user. amountIn argument ; the amount of DAI received from the user, minAmountOut argument ; requests output for the amount of FEI given to the...

TribeRedeemer.redeem function can possibly revert when block gas limit is reached

Lines of code Vulnerability details Impact As the following constructor shows, when constructing the TribeRedeemer contract, the number of tokens in tokensReceived that is used to set tokensReceived is not capped. When the redeem function below is called, tokensReceived, which is essentially toke...

reserve0CumulativeLast is incorrectly calculated

Lines of code Vulnerability details Impact It was observed that both reserve0CumulativeLast and reserve1CumulativeLast are incorrectly calculated. Reference can be taken from Uniswap contract which calculates it correctly at Proof of Concept 1. The reserve0CumulativeLast is currently calculated i...

MISSING CHECK OF TOKEN RESULTING IN WRONG ANSWER OF LP TOKEN PRICE

Lines of code Vulnerability details Impact When calculating the LP price, due to the lack of checking of the tokens, if both the token0 and token1 of the pair are not wcanto or note, it will lead to the wrong LP price. Proof of Concept if pair.stable // stable pairs will be priced in terms of Not...

Should add check for Insufficient allowance

Lines of code Vulnerability details Impact There is not check for Insufficient allowance inside transferFrom method. Proof of Concept Tools Used Code analytics Recommended Mitigation Steps requirecurrentAllowance = amount, "ERC20: insufficient allowance"; --- The text was updated successfully, bu...

Comparison of tokens

Lines of code Vulnerability details Impact In function named getUnderlyingPrice the BaseV1Router01 contract desides price of the token by comparing tokens' symbol name with predefined constant. By passing custom token attacker can force returned value of getUnderlyingPrice function to be incorrec...

Price can be manipulated by flashloan

Lines of code Vulnerability details Impact The last observation of the TWAP can be manipulated by a flashloan, which thus manipulates the price. Proof of Concept The price calculated in getPriceLP is based on the last 8 observations. As the last observation may be in the current block it is...

Dividing before multiplying can cause data loss

Lines of code Vulnerability details Impact Note: I'll use the notation decimals here to represent 10 token.decimals, just like th variable defined in the BaseV1Router.getPriceLP function. In the BaseV1Router.getPriceLP function, the token0 TVL is calculated in terms of NOTE, by multiplying the TV...

LP token price calculation suceptible to oracle attack manipulation

Lines of code Vulnerability details Impact The current calculation of the LP token its no accurate. Currently you formula is a the sum of the underlying asset value; sumPiRi / supply Sumatory of each token prices times reserve, divided by total supply, but this is suceptible to oracle manipulatio...

Two-step change of privileged roles

Lines of code Vulnerability details Impact Lack of two-step procedure for critical operations is error-prone and can lead to irrevocable mistakes, might leave the system operationally with no/malicious privileged role. For example, when transfer admin role, in a single-step change, if the current...