BORROWERS CAN AVOID LIQUIDATIONS, IF ERC777 TOKEN IS CONFIGURED AS AN emissionToken

Lines of code Vulnerability details Impact If a borrower is undercollateralized then he can be liquidated by a liquidator by calling the MErc20.liquidateBorrow function. liquidateBorrow function calls the MToken.liquidateBorrowFresh in its execution process. Inside the liquidateBorrowFresh functi...

Any extra reward tokens that accumulate in the contract remain locked there permanently.

Lines of code Vulnerability details Impact Funds get locked in contract resulting to Loss of asset control, funds and increased costs to recover fund Proof of Concept Reviewing the list of external and public functions, there is no withdraw or reclaim function: 2. Scanning the contract code, ther...

the unfollow contract does random unfollow process of random follow token.

Lines of code Vulnerability details Impact in the FollowNft.sol we have to unfollow function this function is supposed to do unfollow process but as you see the followTokenId variable just returns one random follow id with profile id through mapping and there is no option to select which follow n...

Due to revert found during testing it would be wise to implement a rollback and re-whitelist should it be needed

Lines of code Vulnerability details Impact During testing with the Mainnet fork for the migration testing. We needed to make a distinction between V1 Profiles and V2 profiles within the test code, but this is not so in the standard V2 code, and may cause unforeseen issues after the upgrade. The V...

Race condition in approve function can lead to more funds than intended being transferred

Lines of code Vulnerability details Impact The approve function from MToken.sol contains a front-running vulnerability that allows a user to spend more tokens than he should. Proof of Concept Lets take the following scenario: 1. Alice calls approveEve, 10. This permits Eve to spend 10 tokens from...

The FollowNFT.initialize() function will never be executed

Lines of code Vulnerability details Impact This function Initializes the follow NFT. To check if a function has already been initialized use: if initialized revert Errors.Initialized; This condition will always end with revert Errors.Initialized, because in the constructor, when expanding the...

Incorrect liquidity calculations if snapshot errors occur

Lines of code Vulnerability details Impact incorrect liquidity values that undermine the risk checks and constraints of the protocol Proof of Concept getHypotheticalAccountLiquidityInternal does not handle snapshot errors properly. Specifically: It calls MToken.getAccountSnapshot to get the...

setDirectPrice is vulnerable to sandwich attack

Lines of code Vulnerability details Impact In ChainlinkOracle.sol we have setDirectPrice: function setDirectPriceaddress asset, uint256 price external onlyAdmin emit PricePostedasset, pricesasset, price, price; pricesasset = price; This function setDirectPrice allows the admin...

The processBlock() function does the wrapping process wrongly

Lines of code Vulnerability details Impact The blocking process in the FollowNFT contract needs to wrap it first, but it does the wrapping process wrongly. wrapping process in wrap function update some statement and then mint token but if you look at processBlock function, it's just mint token an...

FollowNFT storage collision

Lines of code Vulnerability details Impact The lastFollowTokenId of FollowNFT contract has a storage collision. V2.0 storage layout: | lastFollowTokenId | uint128 | 17 | 0 | 16 | contracts/FollowNFT.sol:FollowNFT | | followerCount | uint128 | 17 | 16 | 16 | contracts/FollowNFT.sol:FollowNFT |...

The _rescueFunds function allows sweeping any tokens, when it should only allow sweeping of the underlying asset

Lines of code Vulnerability details Impact abuse of sweeping arbitrary tokens. Proof of Concept The rescueFunds function allows sweeping any tokens, when it should only allow sweeping of the underlying asset Tools Used Manual Recommended Mitigation Steps Remove the tokenAddress parameter - no nee...

processBlock() function forcibly wrapping a follow NFT could lock it without the owner's consent

Lines of code Vulnerability details Impact It locks the NFT against the owner's wishes. Proof of Concept processBlock is called by the LensHub when a profile is blocked It first checks if the follow NFT is wrapped using isFollowTokenWrapped If not wrapped, it forces wrapping by minting to the own...

initialize() function can manipulated by attacker

Lines of code Vulnerability details Impact initialize function in the FollowNFT.sol contract is external and everyone can call this function. comment in the code says: "This is called right after deployment by the LensHub, so we can skip the onlyHub check." But in this scenario, attacker can call...

if _rescueFunds was called with the address of a mToken, the admin would currently be able to sweep those tokens,

Lines of code Vulnerability details Impact It allows the admin to steal deposited funds from users It removes mTokens used as collateral to back borrows Proof of Concept Assume there is a mToken at address 0x123 that has issued some tokens. The admin calls rescueFunds0x123, uint.max. This will...

profileIdAllowedToRecover is not handled properly in tryMigrate()

Lines of code Vulnerability details Impact In FollowNFT.sol, when calling tryMigrate, the state at the end should be the same when you call baseFollow and fresh follow the owner of the collection. However, profileIdAllowedToRecover is not handled inside of tryMigrate and it should be deleted as...

Missing Input Validation and Error Definition

Lines of code Vulnerability details Impact Missing Input Validation and Error Definition of globalSupplyIndex & globalBorrowIndex in L827-L844 & L865-L883 respectively of MultiRewardDistributor.sol could create complications as "sub" function of L844 & L883 would stop execution in cases of...

Signature malleability not protected against

Lines of code Vulnerability details Impact A signature should never be included into a signed message hash to check if previously messages have been processed by the contract. See reference: Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any othe...

The owner can call _upgrade directly, skipping executeLensV2Upgrade.

Lines of code Vulnerability details Impact Loss of funds due to skipped checks before transfers Invalid system state due to assuming conditions not verified Hiding failed upgrade due to skipped revert/events Proof of Concept upgrade is missing an onlyOwner modifier By calling upgrade directly, th...

Possible integer underflow

Lines of code Vulnerability details Impact The previous FollowNFT implementation is different between v1.3 and v2.0. The followerCount is 0 for existing FollowNFTeven if lastFollowTokenId is not 0 after upgrade. // Old uint256 lastFollowTokenId slot splitted into two uint128s to include...

Users repay more than the approved amount.

Lines of code Vulnerability details Impact More tokens can be repaid than were approved leading to loss of funds Proof of Concept The repayBorrowFresh function does the following: 1. Checks if repay is allowed by calling comptroller.repayBorrowAllowed with the input repayAmount. 2. Fetches the...