arbitrage on stake()

Lines of code Vulnerability details Issue: there is a huge arb opportunity for people who deposit 1 block before the rebase Consequences: then they can call instantUnstakeReserve or instantUnstakeCurve to unstake the staked amount, in this way the profit that needs to be distributed on the next...

wrong passing value in rebase function

Lines of code Vulnerability details Impact wrong information in rebases array Proof of concept rebase function should pass the totalStakedBefore the totalSupply before adding the profit to function storeRebase, but as in the code rebase pass the updatedTotalSupply Tools Used Manual review...

_storeRebase() is called with the wrong parameters

Lines of code Vulnerability details storeRebase's signature is as such: Yieldy.solstoreRebase File: Yieldy.sol 104: / 105: @notice emits event with data about rebase 106: @param previousCirculating uint 107: @param profit uint 108: @param epoch uint 109: / 110: function storeRebase 111: uint256...

Yieldy._storeRebase() saves and emits wrong values.

Lines of code Vulnerability details Impact Yieldy.storeRebase saves and emits wrong values. I don't think the asset will be lost directly because of this but the rebase storage will have wrong values and it might affect the system later. Proof of Concept The previousCirculating must be a previous...

It's possible to perform DOS and fund lose in Stacking by transferring tokens directly to contract

Lines of code Vulnerability details Impact Function rebase in contract Staking calls Yieldy.rebaseprofit, and Yieldy.rebaseprofit, would revert if rebasingCredits / updatedTotalSupply was equal to 0. it's possible to transfer some STAKINGTOKEN directly to Stacking contract before or after...

[PNM-003] _totalStakedBefore_ and _totalStakedAfter_ are the always the same

Lines of code Vulnerability details Description It can be medium or high according to the off-chain logic which is not avaiable for the contest. Specifically, rebases can only be updated by function storeRebase and the only callsite of function storeRebase is in function rebase. While we have...

xorg-x11-server and xorg-x11-server-Xwayland security update

xorg-x11-server 1.20.11-5 - Fix crash with NVIDIA proprietary driver with Present 2046329 1.20.11-4 - CVE fix for: CVE-2021-4008 2030162, CVE-2021-4009 2030172, CVE-2021-4010 2030175, CVE-2021-4011 2030181 1.20.11-3 - xf86/logind Fix drmdropmaster before vtreldis Resolves: 1771863...

libpq security update

13.5-1 - Rebase to 13.5 Resolves: 2023294...

virt:ol and virt-devel:ol security, bug fix, and enhancement update

hivex 1.3.18-23 - Limit recursion in ri-records CVE-2021-3622 resolves: rhbz1976194 1.3.18-22.el8 - Resolves: bz2000225 Rebase virt:rhel module:stream based on AV-8.6 libguestfs 1.44.0-5.0.1 - Replace upstream references from description tag - Config supermin to use host yum.conf in ol8 Orabug:...

go-toolset:ol8 security and bug fix update

delve 1.7.2-1.0.1 - Disable DWARF compression which has issues Alex Burmashev 1.7.2-1 - Rebase to 1.7.2 - Related: rhbz2014088 golang 1.17.7-1 - Rebase to Go 1.17.7 - Remove fips memory leak patch fixed in tree - Resolves: rhbz2015930 go-toolset 1.17.7-1 - Rebase to Go 1.17.7 - Remove fips memory...

Rebasing tokens lock excess balance in contract

Lines of code Vulnerability details Rebasing tokens lock excess balance in contract If a vault is created with a rebasing ERC20 as its token, additional balance accrued through rebases while the token is owned by the vault may be locked in the contract. If the rebasing token balance decreases whi...

mariadb:10.5 security, bug fix, and enhancement update

galera 26.4.9-4 - Use downstream garbd-wrapper and garbd.service to ensure compatibility - Add upstream versions of garbd-wrapper called garbd-systemd and garbd.service in case user want's to use them 26.4.9-3 - Explicitly require the 'procps-ng' package - Otherwise it will not require it in the...

nodejs:14 security, bug fix, and enhancement update

nodejs 1:14.18.2-2 - Add missing fixes - Resolves: RHBZ2027642, RHBZ2027635 1:14.18.2-1 - Resolves: RHBZ2027609 - Resolves: RHBZ2027649, RHBZ2027646, RHBZ2027642, RHBZ2027635 - Rebase to new version to fix CVEs...

ALEA-2022:0354 vulkan bug fix and enhancement update

The vulkan packages contain the reference ICD loader and validation layers for Vulkan, a graphics and compute API for cross-platform access to modern GPUs. Bug Fixes and Enhancements: Rebase vulkan-loader in 8.6 BZ2016391 Rebase vulkan-headers in 8.6 BZ2016392 Rebase spirv-headers in 8.6 BZ201639...

vulkan bug fix and enhancement update

The vulkan packages contain the reference ICD loader and validation layers for Vulkan, a graphics and compute API for cross-platform access to modern GPUs. Bug Fixes and Enhancements: Rebase vulkan-loader in 8.6 BZ2016391 Rebase vulkan-headers in 8.6 BZ2016392 Rebase spirv-headers in 8.6 BZ201639...

nginx:1.20 security update

1.20.1-1.0.1 - Remove Red Hat references Orabug: 29498217 1:1.20.1-1 - rebase to 1.20.1 addressing CVE-2021-23017...

Attacker can collect all positive rebase from the poll

Handle gzeon Vulnerability details Impact The concept of ElasticSwap is not to change relative price upon positive rebase event. However, this allow an attacker to sandwich a known positive rebase event for profit. Proof of Concept 1. Assuming we have pool with 10000 base and 10000 quote token 2...

calculateQuoteTokenQty() Does Not Check Rebase Event May Cause MisPricing

Handle Meta0xNull Vulnerability details Impact // xy=k - we track these internally to compare to actual balances of the ERC20's When Rebase Event Happen, the curve change and affect Pricing for Both Buy & Sell. calculateBaseTokenQty Do Check if Experience Quote Token Decay / a Rebase Down event a...

Wrong lastBuyBackPrice

Handle cmichel Vulnerability details The sYETIToken.lastBuyBackPrice is set in buyBack and hardcoded as: function buyBackaddress routerAddress, uint256 YUSDToSell, uint256 YETIOutMin, address memory path external onlyOwner requireYUSDToSell 0, "Zero amount"; requirelastBuybackTime + 69 hours...

Yeti token rebase checks the additional token amount incorrectly

Handle hyh Vulnerability details Impact The condition isn't checked now as the whole balance is used instead of the Yeti tokens bought back from the market. As it's not checked, the amount added to effectiveYetiTokenBalance during rebase can exceed the actual amount of the Yeti tokens owned by th...