Ownership transfer not correctly handled for flash loans

Lines of code Vulnerability details Impact In response to a flashloan, proxyRegistry.getCurrentProxyowner is used to retrieve the correct user proxy and check that this proxy has initiated the flash loan. This can be problematic after ownership transfers of the proxy, where...

Project.changeOrder() might reinitialize already completed task.

Lines of code Vulnerability details Impact changeOrder can be used to change subcontractor. But if a project builder approves the signature by fault or the contractor is delegated, a malicious contractor and subcontractor might reinitialize an already completed task and complete again to receive...

Community can lose interest because interest was calculated by days instead of seconds

Lines of code Vulnerability details Impact Community's owner lose amount of interest from project up to half of total interest Proof of concept When builder repay any loan amount by function repayLender or community call function lendToProject, function claimInterest in contract Community will be...

Lack of check for fee tokens

Lines of code Vulnerability details Impact The lendToProject function will receive the cost as an argument. However, some tokens will charge a fee, which might cause the balance of the token in the contract mismatch the cost. File: contracts/Project.sol /// @inheritdoc IProject function...

New owner of user proxy can prevent old owner from using the system

Lines of code Vulnerability details Impact In deployFor, owner is called if there is already an entry for the provided address. This can be exploited by a sophisticated attacker to make the system completely unusable for a user. Proof Of Concept Alice transfers her proxy to Bob through...

No storage gap for Upgradable contract might lead to storage slot collision

Lines of code Vulnerability details Impact For upgradeable contracts, there must be storage gap to “allow developers to freely add new state variables in the future without compromising the storage compatibility with existing deployments” quote OpenZeppelin. Otherwise it may be very difficult to...

Add cancel and refund option for Transaction Recovery

Lines of code Vulnerability details Add cancel and refund option for Transaction Recovery Impact Transactions could fail or stuck, according to the documentation: Occasionally, transactions can get "stuck" in the pipeline from a source to destination chain e.g. due to one-off issues that arise wi...

AxelarDepositService: When wrappedToken is not weth, sendNative may cause users to lose ether.

Lines of code Vulnerability details Impact In the sendNative function of the AxelarDepositService contract, the wrappedToken address is treated as weth-like and the wrappedToken's deposit function is called. If the wrappedToken address is TokenType.External token and is not weth-like and the...

Use safetransfer/safetransferFrom consistently instead of transfer/transferFrom

Lines of code Vulnerability details Impact Its a good to add require statement to checks the return value of token transfer or using safetransfer or safetransferFrom on Openzeppelin to ensure the token revert when transfer failure. Failure to do so will cause silent failures of transfer and affec...

Malicious DepositBase may stole dust fund from ReceiverImplementation

Lines of code Vulnerability details Impact Malicious DepositBase may stole dust fund from ReceiverImplementation Proof of Concept // @dev This function is used for delegate by DepositReceiver deployed above // Context: msg.sender == AxelarDepositService, this == DepositReceiver function...

Possible to delegate same token

Lines of code Vulnerability details Impact It's possible to call delegatetokenId1, tokenId2 using the same token tokenId1 multiple times. The previous delegated value isn't deleted, and all delegations stack up. This way tokenId2 will have all these tokens as delegated:...

arbitrary low level call

Lines of code Vulnerability details Impact An attacker may perform call to an arbitrary address with controlled calldata Proof of Concept File: contracts\DepositHandler.sol: 23 if callee.code.length == 0 revert NotContract; 24: success, returnData = callee.calldata; 25 references: Tools Used vsco...

Able to delegate multiple times with the same tokenId

Lines of code Vulnerability details The delegate function in VoteEscrowDelegation.sol is used to delegate voting power from one tokenId to another. The tokenId is added to the toTokenId's delegatedTokenIds array which contains all tokenIds that have delegated to the toTokenId. The amount of votes...

Impossible to add ve in RewardDistributor

Lines of code Vulnerability details Impact Starting from ve == 0, we call addVoteEscrow. function addVoteEscrowaddress voteEscrow external onlyOwner if addressve == address0 ve = VEpendingVoteEscrow; else voteEscrowEnableDate = block.timestamp + 1 days; pendingVoteEscrow = voteEscrow; The functio...

High risk with links to code

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...

Really really really really really really really really really really really really really really really really really really really really really really really really really really really really really really really really really really long title

Lines of code L123 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps ---...

Unchecked Return Value for transfer & transferFrom call

Lines of code Vulnerability details Impact It is good to add a require statement that checks the return value of token transfers or to use something like OpenZeppelin’s safeTransfer/safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so will cause silen...

ETHRegistrarController.renew should call NameWrapper.renew

Lines of code Vulnerability details Impact NameWrapper.renew has an onlyController modifier. And ETHRegistrarController should be the controller of NameWrapper Otherwise ETHRegistrarController.register cannot call NameWrapper.registerAndWrapETH2LD. Therefore, ETHRegistrarController.renew should...

Reentrancy for function call before state update

Lines of code Vulnerability details Impact An external call "transfer" is made before updating state data through "setFuses" and "setFuses" does not depend on any data from "transfer". . Proof of Concept Reentrancy is not only an effect of Ether transfer but of any function call on another...

Reentrancy from _transferAndBurnFuses

Lines of code Vulnerability details Impact Reentrancy attack Proof of Concept The function transferAndBurnFuses is not performing Checks-Effects-Interactions pattern, and updates fuses after NFTs are transfered. An attacker can reenter because transfer is performing a doSafeTransferAcceptanceChec...