Potential frozen projectTokens due to discrepancy in reservedRate

Lines of code Vulnerability details The handling of projectToken in swap follows 3 steps: Burn all the reserved token in the delegate 293: controller.burnTokensOf 294: holder: addressthis, 295: projectId: data.projectId, 296: tokenCount: reservedToken, 297: memo: "", 298: preferClaimedTokens: tru...

arbitrary reservedRate value will result the next swap to be wrongly executed

Lines of code Vulnerability details Impact the function "payParams" will set the variable reservedRate without checking the effective value of that param,in fact if someone decides to call the "payParams" function passing as data.reservedRate a number 10k will result in the next swap that will...

Failure to check reservedRate can lead to a decrease in assets

Lines of code Vulnerability details Impact The payParams function takes the data parameter, which contains the reservedRate. If reservedRate exceeds MAXRESERVEDRATE, then this causes nonReservedToken to be incremented. This results in a decrease in assets and a larger mint. Proof of Concept...

Malicious user can Mint infinite amount of project tokens as anyone can call payParams function through malicious input and set the _tokenCount .

Lines of code Vulnerability details Impact Malicious user can Mint infinite amount of project tokens as anyone can call payParams function through malicious input and set the tokenCount. The payparams function calculates the tokenCount variable which refers to the amount of token to be minted or...

mintedAmount and reservedRate mutex not working

Lines of code Vulnerability details Impact File: JBXBuybackDelegate.sol 101 / 102 @notice The amount of token created if minted is prefered 103 104 @dev This is a mutex 1-x-1 105 / 106 uint256 private mintedAmount = 1; 107 108 / 109 @notice The current reserved rate 110 111 @dev This is a mutex...

Attacker can front-run didPay() by calling payParams() to set mintedAmount & reservedRate, reducing output amount

Lines of code Vulnerability details Impact Attacker can front-run didPay by calling payParams to set mintedAmount & reservedRate. This will reduce the output amount the caller to didPay was expecting to receive. Proof of Concept Anyone can call payParams and provide arbitrary input to set...