fractionPrice precision can be lost if fractional tokens supply is high enough

Lines of code Vulnerability details Buyout's start now determine fractional token price by dividing native tokens amount by total supply number. Whenever the supply is high enough the precision can be lost, leading to severe losses to buyout proposer as his staked fractional tokens can be valued ...

zeroswap/UniswapV2Pair.sol Token reserves per lp token can be manipulated due to lack of MINIMUM_LIQUIDITY when minting the first liquidity with migrator

Lines of code Vulnerability details if totalSupply == 0 address migrator = IUniswapV2Factoryfactory.migrator; if msg.sender == migrator liquidity = IMigratormigrator.desiredLiquidity; requireliquidity 0 && liquidity != uint256-1, "Bad desired liquidity"; else requiremigrator == address0, "Must no...

Precision Loss During Division

Lines of code Vulnerability details Proof-of-Concept Assume that toSwap = 10 DAI and pathLen = 3 in this example. Therefore, the bridge will pull 10 DAI from the RouterFacet contract. However, within the BridgeFacet.handleExecuteLiquidity function, due to precision loss when solidity handles...

User can bypass entryFee by sending arbitrary calldata to ParaSwap operator

Lines of code Vulnerability details Impact Any user is able to bypass the entryFee collection when using NestedFactory.create by passing in arbitrary calldata when using the ParaSwap router. High level, a user can pass in calldata to swap from a miniscule amount of input token to an ERC777 with...

[WP-H1] A malicious early user/attacker can manipulate the vault's pricePerShare to take an unfair share of future users' deposits

Lines of code Vulnerability details This is a well-known attack vector for new contracts that utilize pricePerShare for accounting. / @notice Calculates the number of shares that should be minted or burnt when a user deposit or withdraw. @param tokens Amount of asset tokens @return Number of...

requiredImprovementRate can not work as expected when previousInterestRate less than 10 due to precision loss

Lines of code Vulnerability details uint256 previousInterestRate = loan.perAnumInterestRate; uint256 previousDurationSeconds = loan.durationSeconds; requireinterestRate = previousDurationSeconds, 'NFTLoanFacilitator: duration too low'; requirepreviousLoanAmount requiredImprovementRate / SCALAR =...

DropPerSecond is not updated homogeneously, the rewards emission can be much higher than expected in some cases

Lines of code Vulnerability details function updateDropPerSecond internal returns uint256 // If no more need for monthly updates = decrease duration is over ifblock.timestamp startDropTimestamp + dropDecreaseDuration // Set the current DropPerSecond as the end value // Plus allows to be updated i...

Reward calculations can be rendered to zero due to the lack of precision

Lines of code Vulnerability details Impact On a combination of high enough token value and low enough decimals there can be not enough precision to store reward amount, which can be permanently hid from a user as a result. I.e. on such a combination there will effectively be no rewards for some...

[WP-H17] Users will lose a majority or even all of the rewards when the amount of total shares is too large, due to precision loss

Lines of code Vulnerability details function getUpdatedAccTokenPerShareaddress baseToken public view returns uint256 uint256 accumulator = 0; uint256 lastUpdatedTime = poolInfobaseToken.lastRewardTime; uint256 counter = block.timestamp; uint256 i = rewardRateLogbaseToken.length - 1; while true if...

[WP-H8] Wrong formula for the fee to be added to the incentivePool

Lines of code Vulnerability details The protocol takes part of the fees to incentivize liquidity, which is recorded as incentivePooltokenAddress on LiquidityPool.sol. However, the formula used to calculate the updated amount of incentivePooltokenAddress in the current implementation is wrong...

[WP-H1] The value of LP token can be manipulated by the first minister, which allows the attacker to dilute future liquidity providers' shares

Handle WatchPug Vulnerability details For the first minter of an Exchange pool, the ratio of X/Y and the totalSupply of the LP token can be manipulated. A sophisticated attacker can mint and burn all of the LP tokens but 1 Wei, and then artificially create a situation of rebasing up by transferri...

[WP-H27] IndexTemplate.sol#compensate() will most certainly fail

Handle WatchPug Vulnerability details Root Cause Precision loss while converting between the amount of shares and the amount of underlying tokens back and forth is not handled properly. uint256 shortage; if totalLiquidity amount //Insolvency case shortage = amount - value; uint256 cds =...

Lost fees due to precision loss in fees calculation

Handle kenzo Vulnerability details In fees calculation, division is being used in the midst of the calculation, not at the end of it. This leads to lost precision in fee amount as solidity doesn't save remainder of division. Division should happen at the end to maintain precision. Impact Lost fee...

YearnVault.sol#pull() will most certainly fail

Handle WatchPug Vulnerability details for uint256 i = 0; i balance yTokenAmount = balance; if yTokenAmount == 0 continue; yToken.withdrawyTokenAmount, to, maxLoss; tokenAmountsi, addressthis; actualTokenAmounts = tokenAmounts; The actual token withdrew from yToken.withdraw will most certainly be...

YaxisVaultAdapter.sol#withdraw() will most certainly fail

Handle WatchPug Vulnerability details The actual token withdrawn from vault.withdraw will most certainly less than the amount, due to precision loss in tokensToShares and vault.withdraw. As a result, IDetailedERC20token.safeTransferrecipient, amount will revert due to insufficant balance. Based o...

Dao.calcReward(address) has potential division before multiplication arithmetic errors

Handle heiho1 Vulnerability details Impact Dao.calcRewardaddress on lines 203 and 204 are potentially problematic in that division may potentially truncate values resulting in loss of precision. Proof of Concept Tools Used Slither Recommended Mitigation Steps Potentially this issue is lessened wi...

The vulnerability of the Android operating system’s loading image processing service allows a hacker to cause the device to freeze and restart.

The vulnerability of the Android operating system’s image loading processing service arises from a loss of precision in integer arithmetic. Exploiting this vulnerability can allow an attacker to cause the device to freeze and restart remotely...

The vulnerability of the Android operating system, which allows a perpetrator to obtain confidential information or enhance their privileges

The vulnerability in the drivers/char/diag/diagdci.c file of Qualcomm’s Android operating system arises from a loss of integer precision. Exploiting this vulnerability can allow an attacker to increase their privileges or obtain confidential information through a specially created application...

The vulnerability of the Firefox browser, which allows a violator to trigger a service failure or cause other effects

The vulnerability of the srtpunprotect function in the Firefox WebRTC implementation arises due to a loss of precision in integer arithmetic. Exploiting this vulnerability can allow an attacker to cause a service failure or other effects such as memory corruption from a remote location...

The vulnerability of the Firefox browser, which allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the Brotli algorithm implemented in the Firefox browser arises from the loss of precision for integer operations. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause a service failure by using specially crafted data compressed using the...