Upgraded Q -> 2 from #255 [1684436602164]

Judge has assessed an item in Issue 255 as 2 risk. The relevant finding follows: QA-03: Anyone can memorialize LP positions from another user Description The function PositionManager.memorializePositions contains no access control. This means anyone can memorialize other LP's positions, provided...

Upgraded Q -> 2 from #467 [1684434787599]

Judge has assessed an item in Issue 467 as 2 risk. The relevant finding follows: L-03 Anyone can memorialize other users' position if the owner approves PositionManager There isn't a check to ensure that the caller is the actual owner of the position, so anyone can memorialize a position if the...

PositionManager's moveLiquidity can freeze funds by removing destination index even when the move was partial

Lines of code Vulnerability details positionIndex.removeparams.fromIndexremoves the PositionManager entry even when it is only partial removal as a result of IPoolparams.pool.moveQuoteToken... call. I.e. it is correct to do fromPosition.lps -= vars.lpbAmountFrom, but the resulting amount might no...

PositionManager's moveLiquidity can set wrong deposit time and permanently freeze LP funds moved

Lines of code Vulnerability details moveLiquidity set new destination index LP entry deposit time to be equal to the source index deposit time, while destination bucket might have defaulted after that time. This is generally not correct as source bucket bankruptcy is controlled i.e. LP shares tha...

Using memory instead of storage in 'redeemPositions' will result in incorrect LP Balance

Lines of code Vulnerability details Impact This bug could lead to a situation where a user can 'redeem' their positions without the associated liquidity positions LPs being properly reset. This could result in the user being able to artificially inflate their LP balance, which could lead to...

Race condition vulnerability in positionManager minting function

Lines of code Vulnerability details Impact race condition vulnerability can result in the issuance of duplicate token IDs. When multiple transactions are executed in quick succession attempting to mint tokens, they may end up being assigned the same ID due to a shared counter or variable used to...

Inconsistence input of depositTime might lead to unexpected result

Lines of code Vulnerability details Impact Inconsistency by relying on depositTime at positions hashmap instead of reading the value from lenderInfo Proof of Concept The depositTime is being read from fromPosition.depositTime at moveLiquidity function and not from lenderInfo L268 and L285...