High possibility of DOS

Lines of code Vulnerability details Impact In the claimAuction function there is a high possibility of DOS where the auction winner is unable to claim the NFT due to high gas cost or not enough gas, this is due to the functions having three loops on same array of all bids, they are in the...

Re-enterancy in AuctionDemo contract

Lines of code Vulnerability details Impact claimAuction function of AuctionDemo contract transfers the token to highest bidder winner and the bid amount is transferred to the owner. Moreover, refund is sent to all remaining participants non-winners of the auction via call function. However, if a...

DoS: Auction May Be Made Unusable By An Attacker

Lines of code Vulnerability details Impact When the items of auctionInfoData array is sufficiently high, claimAuction, cancelAllBids, returnHighestBid will all not be able to be called due to the block gas limit rendering all funds locked and auction unusable. auctionInfoData can only ever be add...

Missing highBid value update returnHighestBidder would return the wrong HighestBidder causing nft to be minted to the wrong winner

Lines of code Vulnerability details Impact returnHighestBidder is used in checking who the winner is, however the code implemented in doing this was flawed as it missed updating highBid variable for the current higest bid found so far before next iteration. Missing this would cost function to...

Users get pay for multiple NFTs and only get 1 minted

Lines of code Vulnerability details Impact Users get only 1 NFT after paying for multiple or more than one Proof of Concept In MinterContract.mint users can mint more than one token and are allowed to pay for the number of tokens minted. function mint uint256 collectionID, uint256 numberOfTokens,...

Royalty Payment Invariant Violation

Lines of code Vulnerability details Impact The vulnerability in the payment mechanism of the smart contract significantly impacts the protocol's functionality. The root cause of the vulnerability is that, despite the README stating an invariant that "Payments can only be made when royalties are...

Minting nft with Index 0 is not allowed

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The constructor of the NextGenCore.sol contract includes an increment operation for the newCollectionIndex variable, ensuring that the newCollectionIndex start from 1. While adding or modifying addition...

Artist Royalty Split Proposal Functionality Missing

Lines of code Vulnerability details Impact The protocol's documentation specifies that royalty splits can be proposed by the artist and accepted by the admin. However, the MinterContract does not implement the functionality for artists to propose royalty splits. This inconsistency between the...

Upgraded Q -> 2 from #385 [1699689442074]

Judge has assessed an item in Issue 385 as 2 risk. The relevant finding follows: L-04 ODSafeManager.allowSAFE function enables any allowed address to add/remove other allowed addresses Details The ODSafeManager.allowSAFE function is meant by design to allow/disallow any address to manage the safe...

payable.transfer() call will result in loss of unused Ether

Lines of code Vulnerability details Impact batchContribute function carries out funding and transfer in batches by using the payable.transfer call. This is unsafe as transfer has hard coded gas budget and can fail when the user is a smart contract. This way programmatical usage of batchContribute...

Vote power can be manipulated to propose and/or pass needed proposals

Lines of code Vulnerability details Impact The PartyGovernance contract is susceptible to vote manipulation, as an attacker could potentially acquire a substantial loan, even without collateral, within a single block before submitting a proposal. The voting process solely considers this particula...

Reentrancy on batchRefund making external call

Lines of code Vulnerability details Impact Reentrancy can occur when the refund function being called inside the batchRefund function allows external contract calls that can trigger the batchRefund function again before the previous execution is completed. Proof of Concept The batchRefund functio...

No validation for the partyFactory contract !

Lines of code Vulnerability details Impact Malicious party contract can be deployed ! Proof of Concept Party contracts are created by the proxyFactory contract . In the initialize function , the proxyFactory contract address is provided by the user which may bring catastrophic consequences . This...

Hosts should agree before performing operations like setting ragequit, vetoing

Lines of code Vulnerability details Impact Since a Party can have multiple hosts, they should agree before vetoing or setting rageQuit, to prevent a single compromised host from having absolute decision, just as is done when hosts accept a proposal Proof of Concept In PartyGovernanceveto and...

Arthimetic operation result in loss of voting power

Lines of code Vulnerability details Impact Carrying out calculation of voting power in function finalize based on division with value 1e4, then subtracting it with totalContributions and after that multiplying and dividing again will be a resultant that cause large precision error or even loss of...

User loss his delegated voting power after delegation to another user.

Lines of code Vulnerability details Vulnerability Details When a user delegate voting power to another user, his previous voting power from delegation has been ignored at getVotingPowerAt since in case isDelegated is true getVotingPowerAt returns 0. Impact Delegated voting power cannot be utilize...

In the _initialize function of the ETHCrowdfundBase contract, when minTotalContributions is equal to maxTotalContributions, crowdfund will never reach its minimum goal in some specific scenarios

Lines of code Vulnerability details Impact In the initialize function of the ETHCrowdfundBase contract, when minTotalContributions is equal to maxTotalContributions, crowdfund will never reach its minimum goal in some specific scenarios. The ETH of users who contribute to this crowdfund will be...

Host(s) + majority can steal assets of minority+other hosts without any option for minority(+otherhosts) to ragequit.

Lines of code Vulnerability details Impact The ragequit functionality is put in place to protect the rights of the minority, who are not in support of a proposal, and allow them to withdraw their share of assets and exit the party. In some cases, minority will not have the opportunity to ragequit...

Vulnerability in Token Withdrawal Function

Lines of code Vulnerability details Impact Flawed logic in token withdrawal function allows for selective withdrawal of high-value tokens and fails in single-token scenarios. // Sum up total amount of each token to withdraw. uint256 memory withdrawAmounts = new uint256; IERC20 prevToken; for...

Unbounded iteration over all index

Lines of code Vulnerability details Impact The transactions could fail if the array get too big and the transaction would consume more gas than the block limit. This will then result in a denial of service for the desired functionality and break core functionality. Proof of Concept Functions like...