there is rounding error when price is below 10

Lines of code Vulnerability details Impact fee will be zero when price is below in get minting price Proof of Concept uint256 public constant NFTFEEBPS = 1000; function getNFTMintingPriceuint256 id, uint256 amount public view returns uint256 fee address bondingCurve = shareDataid.bondingCurve;...

Unhandled contract ownership states can lead to unexpected behaviour

Lines of code Vulnerability details Impact OpenZeppelin's Ownable2step library's ownership states can lead unexpected behavior in certain functions Proof of Concept The ownable2step contract includes a pendingOwner entity which defines an address ownership has been transferred to but has not...

Lost fees

Lines of code Vulnerability details Impact Buyers do not get any split of the fees. It is instead to be distributed to holders. But holder splits on successive buys are partially lost to the contract and cannot be recovered. Proof of concept The buyer's rewardsLastClaimedValueidmsg.sender is...

withdrawCarry will not work

Lines of code Vulnerability details Description When calculating the amount of interest gathered this calculation is done: asD::withdrawCarry: File: asD/src/asD.sol 73: uint256 exchangeRate = CTokenInterfacecNote.exchangeRateCurrent; // Scaled by 1 10^18 - 8 + Underlying Token Decimals, i.e. 10^2...

Incorrect fee splitting logic

Lines of code Vulnerability details Impact The fee splitting logic does not properly attribute holder and creator rewards. By splitting fees from the total rather than incrementally, it distorts the proportional rewards earned over time. This could undermine the incentive structures and alignment...

D.O.S due to wrong scaling factor

Lines of code Vulnerability details Impact The cNote token which is a fork of the CToken contract has a scaling method used to handle the exchange rate between CToken and the underlying token. This method helps scale the exchange rate because solidity doesn't handle fixed-point decimals. The...

Not enough check for getPriceAndFee

Lines of code Vulnerability details Impact Edge cases for getPriceAndFee can cause incorrect price to be returned and in turn cause incorrect tokens to be sent to the user. This can occur in the buy and sell function. Proof of Concept In the buy function the function getBuyPrice is called through...

platform will get 40 percent of fee if fee are below 100

Lines of code Vulnerability details Impact PlatForm will get 40 percent of fee when price is below 100 cause of rounding error Proof of Concept uint256 public constant HOLDERCUTBPS = 3300; // 33% uint256 public constant CREATORCUTBPS = 3300; // 33% protocol implement that holder and creator will...

The owner of the asD contract (i.e. the creator) can not withdraw the accrued interest

Lines of code Vulnerability details Impact The asD.withdrawCarry function will always throw an error for all normal totalSupply values due to inappropriate scale factor. So the creator can withdraw the accrued interest only after all users will burn their asD tokens. Proof of Concept The scale...

MEV-attack

Lines of code Vulnerability details Impact Tokens trades can be sandwiched for profit. Proof of concept The price of tokens is proportional to the supply with the current LinearBoningCurve. An attacker can therefore sandwich a buy transaction with a buy at the first lower price range followed by ...

initialization of amount without permission

Lines of code Vulnerability details Impact if users want to pass the input value as 0 which user can pass because there is no require checks for that. in line number 79 amount = maximumWithdrawable this override the amount variable and make it equals to uint256 maximumWithdrawable =...

Possible sandwhich attack whenever a user with a surplus of allowance calls market.buy().

Lines of code Vulnerability details Impact Because the exact amount of allowance a user needs to mint his desired amount of shares isnt always a round number as shown via the market.getBuyPriceid, amount;. There could be users who might trust the contract blind & approve their entire balance in...

Reentrancy leads to minting/burning/buying without paying the correct amount of fees

Lines of code Vulnerability details Impact Fee calculations depends on shareDataid.tokenCount, which is updated AFTER doing the transfer of token. That means, if the token is an ERC777 compatible token, users can reenter the function paying, for example, less fees on a buy operation. Proof of...

user can buy when there's no bonding curve set

Lines of code Vulnerability details Impact Users can buy with no bonding curve set Proof of Concept function buyuint256 id, uint256 amount external /// @audit add a check that ensures there's a bonding curve set requireshareDataid.creator != msg.sender, "Creator cannot buy"; uint256 price, uint25...

Unchecked redeemUnderlying failure allows burning asD without redeeming NOTE, breaking peg.

Lines of code Vulnerability details Impact The burn function does not validate the return code from redeemUnderlying. This means if redeeming fails, asD tokens could be burned without redeeming the underlying NOTE, breaking 1:1 peg. Attacker burns asD tokens and receives NOTE, but contract fails ...

LinearBondingCurve.log2 function contains an incorrect shift operation that could lead to wrong calculation.

Lines of code Vulnerability details Impact The values in the shift operation are reversed. The provided inline assembly code for the log2 function appears to be an issue in the sequence of shift operations. Let's break down the relevant part of the code: r := or r, byte and0x1f, shrshrr, x,...

CVE-2023-47053

Adobe Audition version 24.0 and earlier and 23.6.1 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires...

CVE-2023-44331

Adobe Photoshop versions 24.7.1 and earlier and 25.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user...

CVE-2023-44361 ZDI-CAN-22041: Adobe Acrobat Reader DC AcroForm Doc Object Use-After-Free Information Disclosure Vulnerability

Adobe Acrobat Reader versions 23.006.20360 and earlier and 20.005.30524 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requir...

CVE-2023-44442

A parsing vulnerability was found in the GNU Image Manipulation Program GIMP. This flaw allows an unauthenticated, remote attacker to trick a GIMP user into opening a malicious PSD file, possibly enabling the execution of unauthorized code within the GIMP process. Mitigation Mitigation for this...