NFTXStakingZap: Balance check can result in griefing

Handle GreyArt Vulnerability details Impact The addLiquidity721WETH and addLiquidity1155WETH functions check that the correct number of vault tokens have been minted prior to liquidity provision. uint256 balance = count BASE; // We should not be experiencing fees. requirebalance ==...

Low-level call return value not checked

Handle cmichel Vulnerability details The NFTXStakingZap.addLiquidity721ETHTo function performs a low-level .call in payableto.callvalue: msg.value-amountEth but does not check the return value if the call succeeded. Impact If the call fails, the refunds did not succeed and the caller will lose al...

Staking Zap add liquidity can be denied

Handle cmichel Vulnerability details The NFTXStakingZap.addLiquidity721WETH function verifies if the contract indeed received the expected amount of vault tokens of balance = count BASE by checking: function addLiquidity721WETH uint256 vaultId, uint256 memory ids, uint256 minWethIn, uint256 wethI...

Griefing attack is possible as NFTXStakingZap, PalmNFTXStakingZap, NFTXMarketplaceZap rely on zero vault token balance for LP and minting

Handle hyh Vulnerability details Impact NFTXStakingZap and PalmNFTXStakingZap liquidity provision and NFTXMarketplaceZap minting will be blocked as addLiquidity and mint functions will revert all the time. An attacker can transfer a tiny amount of vault tokens to NFTXStakingZap/PalmNFTXStakingZap...

A vault can be locked from MarketplaceZap and StakingZap

Handle p4st13r4 Vulnerability details Impact Any user that owns a vToken of a particular vault can lock the functionalities of NFTXMarketplaceZap.sol and NFTXStakingZap.sol for everyone. Every operation performed by the marketplace, that deals with vToken minting, performs this check:...

NFTXMarketplaceZap and NFTXStakingZap don't check WETH.transfer result

Handle hyh Vulnerability details Impact Transactions will not be reverted on failed transfer, setting system state as if it was successful. User will have the remainder funds frozen within the system. Proof of Concept NFTXStakingZap and NFTXMarketplaceZap perform unchecked transfers in several...

Use safeTransfer/safeTransferFrom consistently

Handle sirhashalot Vulnerability details Impact A transfer function can fail without reverting. To prepare for such situations, a contract should either check the return value of the transfer function or use a solution such as Open Zeppelin's SafeTransfer function. Only a few places in this proje...

Attacker can break addLiquidity721() by transferring vaultToken to the contract

Handle WatchPug Vulnerability details function addLiquidity721WETH uint256 vaultId, uint256 memory ids, uint256 minWethIn, uint256 wethIn, address to internal returns uint256, uint256, uint256 address vault = nftxFactory.vaultvaultId; requirevault != address0, "NFTXZap: Vault does not exist"; //...

NFTXStakingZap Performs A Dangerous Equality Check Which Can Brick Contract

Handle leastwood Vulnerability details Impact NFTXStakingZap provides an interface for users to interact with NFTX vaults by adding ERC1155/ERC721 tokens as liquidity. The addLiquidity721WETH and addLiquidity1155WETH functions perform strict equality checks on the vaults balance for the...