hardcoded route ratio might hcause verify route return false continously instead use >=

Lines of code Vulnerability details Impact hardcoded rout ratio might cause verify route to return false continuously the verifyroute in ethenaminting.sol is an if that checks whether the route ratio is 10000 or not and the ratio is going to be somewhere around that but what if it actually up wit...

Temporary DOS attack on users minting and redeeming big amount using EthenaMinting.sol

Lines of code Vulnerability details Impact The users redeeming and minting using EthenaMinting.sol with a large amount can be vulnerable to DOS attack. Proof of Concept There is a limit on the max amount to redeem and mint in a block. This can be crucial to the users that are minting or redeeming...

replay exploitation in StakedUSDeV2's unstake function

Lines of code Vulnerability details Impact The vulnerability in the unstake function of the StakedUSDeV2 contract allows the receiver to claim assets without considering the specific round from which they should receive the assets. The receiver can claim assets from a different round than intende...

Wrong estimation of acceptable risk of the protocol losses

Lines of code Vulnerability details Impact The protocol losses in case compromised MINTERS or REDEEMERS can be higher than expected due to the GATEKEEPER suppression. Attacker can frontrun the GATEKEEPER and fill block limit with own transactions while it is profitable. Average losses can be more...

Tokens having Fee-On-Transfer are not considered which will make the protocol in retaining less value than expected.

Lines of code Vulnerability details Impact The balance of the custodian Addresses will be smaller than what is expected, making the protocol fail to maintain the delta neutral position. Proof of Concept The function EthenaMinting.sol/transferCollateral is sending the tokens using safeTransferFrom...

Temporary DOS attack on all the users minting and redeeming.

Lines of code Vulnerability details Impact The users redeeming and minting using EthenaMinting.sol can be DOS'd temporarily for some blocks by an old user having many tokens staked. Proof of Concept The old user having a high staked amount can easily get the order to redeem and mint with the USDe...

Vulnerability in in rescueTokens and _beforeTokenTransfer Functions Allows Self-Transfer of ERC20 Tokens

Lines of code Vulnerability details Impact The rescueTokens function and the beforeTokenTransfer hook in the provided Solidity contract lack checks to ensure that the destination address is not the same as the sender from. This oversight can result in tokens being transferred to the same address,...

Wrong vest logic

Lines of code Vulnerability details Impact The judgment on line 90 results in that the interval between two transferInRewards must be greater than or equal to 8 hours, otherwise it will be reverted. Proof of Concept Tools Used Recommended Mitigation Steps Delete 90 lines of judgment. Assessed typ...

Staking functionality temporary blocking due to lack of address zero check

Lines of code Vulnerability details Impact Though lack of zero check issue for the addToBlacklist function is already at the automated findings output, I suppose it is necessary to show the importance of this check here. In case of accidental or malicious the BLACKLISTMANAGERROLE behavior the...

Reentrancy opened for any contract that calls the withdraw function

Lines of code Vulnerability details Impact Reentrancy opened for any contract that calls the withdraw function in the stakedUSDeV2.sol which would drain of ether. Proof of Concept function withdrawaddress to, uint256 amount external onlyStakingVault USDE.transferto, amount; In this scenario, the...

Rewards transfer In fail

Lines of code Vulnerability details Impact the rewards transfer in will fail when current VESTINGPERIOD is not finished. Proof of Concept "function getUnvestedAmount public view returns uint256" is used to calculate the rest rewards in current VESTINGPERIOD. if the period is finished, the result...

There is no check for collateral token in mint matches same in withdraw

Lines of code Vulnerability details Impact While we understand that usde is the base token here, we see that on minting used token you would need to transfer some tokens to the contract and get some used minted to you and on redemption get usde burnt to get a token sent back to you. The implicati...

replay attack in StakedUSDe's redistributeLockedAmount function

Lines of code Vulnerability details Impact The vulnerability in the redistributeLockedAmount function of the StakedUSDe contract allows an admin user to redistribute tokens from a restricted address to another address. However, if a user let's call them User A is removed from the blacklist and...

vesting amount is overwritten when rewards are transferred consecutively before a user redeems thereby increasing/decreasing the totalAssets value than it actually should be

Lines of code Vulnerability details Impact In StakedUSDe there is a special rewarder role that can transfer additional usde as rewards for users who have staked usde tokens, now consider a scenario where a rewarder transfers 2 usde to the contract and the vesting period of 8 hours pass and the...

A fully blacklisted user can withdraw their funds

Lines of code Vulnerability details Impact A fully blacklisted user should not have access to any function of the protocol, but it is possible for a user to withdraw their funds right before being blacklisted. A fully blocked user is capable of frontrunning the addToBlacklist call by calling the...

bad Actor can block the operation of mint by creating duplicate order by frunt runing original order

Lines of code Vulnerability details Impact bad Actor can block the operation of mint by creating duplicate order by frunt runing original order So basically the contracts are doing orders by users RFQ to system whether by API or front end. and make the mint process the problem is in the contract...

A WHALE CAN DoS A NORMAL USER FROM MINTING AND REDEEMING THE USDe BY MAKING THE MINT AMOUNT AND REDEEM AMOUNT PER BLOCK, EXCEEDING THE maxMintPerBlock AND maxRedeemPerBlock RESPECTIVELY

Lines of code Vulnerability details Impact The EthenaMinting.mint function and EthenaMinting.redeem function both have defined modifiers belowMaxMintPerBlock and belowMaxRedeemPerBlock to ensure the mint amount per block and redeem amount per block are limited to upper bounds set by the...

Lack of functionality to distribute the yield to the USDe stakers.

Lines of code Vulnerability details Impact User will not get the benefit of the yield which is output of their USDe staking. Outcome of yield is the core feature of staking. we are submitting this as high. Proof of Concept An user who is not black listed is allowed to stake their USDe by calling...

jetsafe.de Improper Access Control vulnerability OBB-3768377

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. Dept Of Defense: Elasticsearch is currently open without authentication on https://██████l

An Elasticsearch instance accessible at https://██████l was found to be open without authentication, exposing data to unauthorized access. The vulnerability allowed listing and extraction of sensitive data stored in the Elasticsearch indexes. To mitigate, authentication and authorization controls...