Users can withdraw token multiple times by calling `withdrawStake' thereby depleting the treasury

Lines of code Vulnerability details The withdrawStake function is used to withdraw tokens for an unbounding lock that has existed through an unbounding period. All it needs is the unbondingLockId to carry out the operation. The associated ID gets deleted & the amount that has been bounded is...

A difference in the rDPX price between the oracle and DEXs used for trading can cause more slippage than expected

Lines of code Vulnerability details Impact The protocol will experience much higher slippage than supposed to due to using the wrong price in calculating the amount after slippage. Proof of Concept The protocol executes swaps on Uniswap and Curve. The issue arises due to the protocol using its ow...

Incorrect usage of an uninitialized earnings pool if lastRewardRound >= currentRound.

Lines of code Vulnerability details Impact If lastRewardRound = currentRound, the earningsPool for currentRound may not be initialized if reward has not yet been called for currentRound. So using it to update cumulative rewards or fees could be incorrect. This can lead to incorrect reward...

Initialization Issue in EarningsPoolL

Lines of code Vulnerability details Impact the vulnerable part in code : uint256 prevCumulativeRewardFactor = prevEarningsPool.cumulativeRewardFactor != 0 ? prevEarningsPool.cumulativeRewardFactor : PreciseMathUtils.percPoints1, 1; earningsPool.cumulativeRewardFactor =...

Incorrect slippage calculation in _curveswap function

Lines of code Vulnerability details Impact swaps will fail or execute with higher slippage than intended. Proof of Concept In curveSwap function of RdpxV2Core contract , getEthPrice should be used in place of getDpxEthPrice, and getDpxEthPrice should be used in place of getEthPrice. / @notice...

The order of decreasing total stake for the old delegate and increasing for the new delegate could lead to issues if one reverts but not the other.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept The potential issue is: decreaseTotalStake succeeds in decreasing the old delegate's stake increaseTotalStake reverts and does not increase the new delegate's stake This would incorrect...

.The _newPosPrev/_newPosNext hints do not fully prevent invalid ordering when decreasing a delegate's stake.

Lines of code Vulnerability details Impact The contract could incorrectly deactivate or reward transcoders based on the invalid pool order. Proof of Concept When decreasing a delegate's stake with decreaseTotalStake, the contract calls transcoderPool.updateKey to update the delegate's position in...

Front-running attack can occur between when the unbonding lock is created and when the delegator's bonded amount is decreased.

Lines of code Vulnerability details Impact This would allow the delegator to temporarily have more bonded tokens than they should. They could take advantage of this by voting in governance with the increased voting power or withdrawing increased fees Proof of Concept 1. When unbond is called, an...

A malicious delegator could artificially inflate the deductions for a transcoder, potentially leading to incorrect vote counting.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept In the handleVoteOverrides function, the deductions are added to the transcoder's voter state without any validation: A malicious delegator could call countVote multiple times, each tim...

Malicious users can manipulate the withdrawRound to withdraw their stake before the unbonding period is over.

Lines of code Vulnerability details Impact Disruption the normal bonding incentives and mechanisms in the protocol. Validators or transcoders could withdrew unexpectedly, preventing governance responses to bonded token changes. Proof of Concept The withdrawStake function first checks if the...

Zero Redemption Amount in RdpxDecayingBonds Contract

Lines of code Vulnerability details Impact The redeem function, as described, checks whether the assets to be redeemed assets are not zero. This check is in place to ensure that a user isn't redeeming a non-zero amount of rdpxAmount tokens in exchange for zero assets. Such a check is essential to...

Calling withdraw on a delegated amount of WETH doesn't subtract from totalWethDelegated

Lines of code Vulnerability details Impact The contract's WETH amount gets permanently bricked. Proof of Concept A user can call addToDelegate and give WETH, that other people can use for bonding with their rDPX in exchange for a certain percentage appointed by the delegatee. Delegate memory...

PT-2023-6899

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to and including 2.1.0 Description The issue is related to an improper default REST API permission for Gamma users in Apache Superset, which is connected to shortcomings in the authorization mechanism. This allows a...

missing in calculation parameter issue in Earnings Pool

Lines of code Vulnerability details Impact here is the vulnerable part in code : function getLastTranscoderRewardsEarningsPooladdress transcoder, uint256 round internal view returns uint256 rewardRound, EarningsPool.Data memory pool BondingCheckpoint storage bond = getBondingCheckpointAttranscode...

ERRORNEOUS RETURN VALUE PROVIDED BY THE UniV2LiquidityAmo.getLpTokenBalanceInWeth FUNCTION DUE TO PRECISION ERROR

Lines of code Vulnerability details Impact The UniV2LiquidityAmo.getLpTokenBalanceInWeth function is used to return the LP token balance of the contract in weth. It calls the getLpPrice function which is expected to return the LP price in 1e8 precision. getLpPrice function calls the...

When user unbonds before transcoder calls reward, then cumulativeRewardFactor for the round is less than it should be

Lines of code Vulnerability details Impact When user unbonds before transcoder calls reward, then cumulativeRewardFactor for the round is less than it should be. As result other delegators loose rewards. Proof of Concept Each round transcoder can call reward function in order to claim reward toke...

arbitrum block.number refers to L1 block number, not L2 block number when determining the round

Lines of code Vulnerability details Impact arbitrum block.number refers to L1 block number, not L2 block number Proof of Concept In the current implementation, the round manager use block.number to determine the round However, according to the block.number in arbitrum refers to ethereum mainnet...

Lack of Input Validation and Error Handling

Lines of code Vulnerability details Impact In the slashTranscoder function, the parameters slashAmount and finderFee are directly used for computation without any validity checks. This design overlooks several key issues: There's no check to see if slashAmount or finderFee are within logical...

Potential Over-redemption Vulnerability in redeem Function

Lines of code Vulnerability details Impact In the redeem function, when a third party is using their allowance to redeem shares on behalf of an owner, there exists a potential scenario where the third party could redeem more than originally intended by the owner. Proof of Concept This is how the...

Improperly tracking asset reserve for WETH

Lines of code Vulnerability details Impact Function RdpxV2Corewithdraw lets delegate owners withdraw their unused WETH. However, withdrawn amount is not deducted from totalWethDelegated, which causes WETH asset reserve tracked improperly. The impacts could be: 1. Function sync gets reverted when...