The Transfer event is emitted successfully in MinterContract#mintAndAuction() even when the transaction has failed, leading to inaccurate accounting in off-chain systems.

Lines of code Vulnerability details Impact The airDropTokens function in the NextGenCore contract is responsible for minting and transferring an NFT to a user, exclusively called by the MinterContract. However, the execution of airDropTokens within MinterContractmintAndAuction prior to critical...

Potential Incorrect Domain Separator Generation in _calculateDomainSeparator Function

Lines of code Vulnerability details The calculateDomainSeparator function generates the EIP-712 domain separator using the contract's name and version. However, there is no explicit guarantee that the name has been set before calling this function, leading to an unreliable domain separator. Impac...

Lack of events in EvolvingProteus contract

Lines of code Vulnerability details Impact There is no event emitted in the whole contract, even after executing sensitive actions like swaps between assets or at the constructor. That is bad because many automatic tools that monitors the contracts deployed rely on them. For example, see the swap...

Upgraded Q -> 2 from #16 [1686928129422]

Judge has assessed an item in Issue 16 as 2 risk. The relevant finding follows: L-3 onlyOwner single point of failure Impact The onlyOwner role has a single point of failure and onlyOwner can use critical a few functions. Even if protocol admins/developers are not malicious there is still a chanc...

Go package github.com/cosmos/cosmos-sdk module x/crisis does NOT cause chain halt

x/crisis does NOT cause chain halt Impact If an invariant check fails on a Cosmos SDK network and a transaction is sent to the x/crisis module to halt the chain, the chain does not halt. All versions of the x/crisis module is affected on all versions of the Cosmos SDK. Details The x/crisis module...

Expected payout should not be determined off-chain

Lines of code Vulnerability details Impact Loss of profit and depletion of funds, the latter of which implies that some tickets will be unclaimable. Proof of Concept There is no guarantee to the correctness of LotterySetupParams.expectedPayout, which can be set freely within bounds in...

Liquidation bots are needed to stabilize the system.

Lines of code Vulnerability details Impact Allowing liquidation bots to arbitrage would stabilize the system. The majority of liquidations are done by liquidation bots. For liquidation bots to be viable there has to exist a secondary market where the assets can be instantly sold. This is especial...

[M3] It is impossible to recover stucked non complying ERC-20 tokens

Lines of code Vulnerability details Impact Contract frxETHMinter is unable to recover tokens like USDT PoC Tokens that return void on transfer, that is, those who do not follow ERC20 standard will revert when you try to assign the output to a boolean variable. This is the case in you function...

Hardcoded prices are subject to be abused

Lines of code Vulnerability details Impact Hardcoded prices are subject to be abused which might address the protocol being drained. Proof of Concept There are 2 possible different issues of the Lending Protocol; 1. The attack surface/risk is not originated directly through the Canto protocol but...

CVE-2022-36447

An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be inflated to an arbitrary extent by any holder of any amount of the token. The total amount of the token can be increased as high as the...

CreateFor#JBProjects.sol is vulnerable to reentrancy

Lines of code Vulnerability details Impact Reentrancy attack can trick users by spamming incorrect project Id event emission Proof of Concept The function createFor which uses safeMint is lacking any form a reentrancy protection. OZ Safe Mint implementation is function safeMint address to, uint25...

[PNM-003] _totalStakedBefore_ and _totalStakedAfter_ are the always the same

Lines of code Vulnerability details Description It can be medium or high according to the off-chain logic which is not avaiable for the contest. Specifically, rebases can only be updated by function storeRebase and the only callsite of function storeRebase is in function rebase. While we have...

_validateOrder Does Not Allow Anyone To Be A Taker Of An Off-Chain Order

Handle leastwood Vulnerability details Impact The EIP1271Wallet contract intends to allow the treasury manager account to sign off-chain orders in 0x on behalf of the TreasuryManager contract, which holds harvested assets/COMP from Notional. While the EIP1271Wallet.validateOrder function mostly...

More than one historical lock-position may be represented by a single tokenId

Handle onewayfunction Vulnerability details Impact More than one historical lock-position may be represented by a single tokenId, violating the "uniqueness" property claimed by the xdefi-distribution repo's README.md. Proof of Concept The README.md says: The NFT's score is embedded in the tokenId...

Front-running displacement to beat oracle updates for price manipulation

Handle hack3r-0m Vulnerability details For off-chain oracle, consider: A broadcasted transaction tx1 from a trusted oracle/s changes the price from X to X + d or X -d, this knowledge of update can be harmful and leveraged by malicious actors. If one had to transfer Y amount at current state after...

PrizePool.awardExternalERC721() Erroneously Emits Events

Handle leastwood Vulnerability details Impact The awardExternalERC721 function uses solidity's try and catch statement to ensure a single tokenId cannot deny function execution. If the try statement fails, an ErrorAwardingExternalERC721 event is emitted with the relevant error, however, the faile...

ConcentratedLiquidityPoolHelper.getTickState reverts

Handle cmichel Vulnerability details ConcentratedLiquidityPoolHelper.getTickState allocates only tickCount elements for the ticks array. But the while loop iterates over all ticks of the pool which can potentially become very large, much larger than any tickCount could iterate in a reasonable tim...

nTokenERC20Proxy emits events even when not success

Handle cmichel Vulnerability details Vulnerability Details The nTokenERC20Proxy functions emit events all the time, even if the return value from the inner call returns false indicating an unsuccessful action. Impact An off-chain script scanning for Transfer or Approval events can be tricked into...

nTokenAction does not emit Approval events

Handle cmichel Vulnerability details Vulnerability Details The nTokenAction is supposed to mimic the ERC20 but the allowance changes do not emit the Approval event in nTokenTransferFrom. Impact Off-chain scripts will have the wrong allowance value as it's tracked in nTokenTransferApproveAll but t...

Malicious router can block cross-chain-transfers

Handle cmichel Vulnerability details Vulnerability Details The agreement between the user and the router seems to already happen off-chain because all the fields are required for the initial InvariantTransactionData call already. A router could pretend to take on a user's cross-chain transfer, th...