returnTokensToOwner() in NounsDAOForkEscrow.sol can revert unexpectedly due to improper subtraction

Lines of code Vulnerability details Impact returnTokensToOwner in NounsDAOForkEscrow.sol can revert unexpectedly because of the numTokensInEscrow -= tokenIds.length; math in its logic. tokenIds is an externally supplied argument and it can be larger than the storage variable numTokensInEscrow...

Lack of Access Control in withdrawTokens Function Allows Unauthorized Token Withdrawal

Lines of code Vulnerability details Impact withdrawTokens function lacks proper access control, enabling an attacker to exploit it and withdraw tokens from the escrow to an arbitrary address, since no access control check ensures that only the DAO contract can invoke this function, and as a resul...