Using old oracle prices for estimation users assets before redeeming

Lines of code Vulnerability details Impact Users can avoid correct estimation of assets and redeem more tokens than would redeem in case of estimation with updated oracle prices. Proof of Concept exitMarket function doesn't call oracle.updatePrice before checkRedeemAllowed check at all...

Malicious redeem prevention

Lines of code Vulnerability details Impact Sending FPS to a person affects his voteAnchor and can prevent him from withdrawing money for a long time Proof of Concept Since canRedeem function is using voteAnchor to determine holding period and sending FPS evokes adjustRecipientVoteAnchor, which...

Lack of slippage in redeem can result in loss of shares for redeemer

Lines of code Vulnerability details FPS holders can redeem their shares against zchf using redeem File: Equity.sol 276: function redeemaddress target, uint256 shares public returns uint256 //@audit no slippage, calculateProceeds can return 0 277: requirecanRedeemmsg.sender; 278: uint256 proceeds ...

sFrxEth may revert on redeeming non-zero amount

Lines of code Vulnerability details Impact Unstaking is blocked. Proof of Concept When unstaking the withdraw of each derivative is called. SfrxEth.withdraw calls IsFrxEthSFRXETHADDRESS.redeemamount, addressthis, addressthis;. This function may revert if amount is low due to the following line in...

March 28, 2023—KB5023774 (OS Build 22000.1761) Preview

None None...

Upgraded Q -> 2 from #773 [1679568911031]

Judge has assessed an item in Issue 773 as 2 risk. The relevant finding follows: LACK OF SLIPPAGE PROTECTIONS FOR EOA IN FUNCTIONS LIKE ReaperVaultERC4626.deposit, ReaperVaultERC4626.mint, ReaperVaultERC4626.withdraw, AND ReaperVaultERC4626.redeem --- The text was updated successfully, but these...

Upgraded Q -> 2 from #596 [1677228840417]

Judge has assessed an item in Issue 596 as 2 risk. The relevant finding follows: withdraw and redeem function withdraw IERC4626 vault, address to, uint256 amount, uint256 maxSharesOut public payable virtual override returns uint256 sharesOut ERC20addressvault.safeApproveaddressvault, amount; if...

redeem() should be possible when protocol is Paused but to be able to redeem function grantRTokenAllowance() should be called for any basket tokens and it can only be called when protocol is not paused

Lines of code Vulnerability details Impact Function redeem in RToken contract, redeems RToken for basket collateral and it's callable when protocol is paused. but function redeem transfers basket tokens from BackingManager contract to redeemer and it requires spending allowance of the BackingMang...

Possible Unauthorized Redemption of Collateral ERC20 Tokens due to Lack of Proper Check in redeem() Function

Lines of code Vulnerability details Impact An attacker who is not authorized by the smart contract could potentially redeem more tokens than they are entitled to. This could cause a loss of funds for the smart contract and its users, as well as potentially destabilizing the overall ecosystem...

PROTOCOL MIGHT NOT BE ABLE TO OPERATE DUE TO LACK OF FUNDS

Lines of code Vulnerability details Impact Redeem/withdraw functionality will fail under certain conditions and users who want to redeem/withdraw their AVAX will not be able to. Proof of Concept Users stake their AVAX and in return get ggAVAX. The AVAX provided by the users is then staked by the...

position's wrong profit and loss or incorrect distribution of funds in contract PrePoMarket because it doesn't consider expiryTime for setting the value of finalLongPayout and calculating redeem amounts based on positions and Markets never expire

Lines of code Vulnerability details Impact according to the docs: "The expiry date of the market. If a market has not settled by its expiry date, it will automatically settle at the lower bound of its Valuation Range." but Contract PrePOMarket doesn't consider expiryTime in its logic and...

Users of StakingFundsVault can never redeem their LP token once staking has started

Lines of code Vulnerability details The burnLPToken of a Fees & MEV vault allow users to burn LP tokens in exchange of ETH. Quoting the documentation Every user has a right to leave the LSD network at anytime. A depositor/staker can simply sell their LP tokens to someone else or burn to redeem ET...

redeem WIll Fail If There Is One tokenReceived Has Zero Balance

Lines of code Vulnerability details Impact redeem will always revert if there is one token received has zero balance, and user will not able redeem their token. So the token will lock in that contract. Proof of Concept Suppose, user A wants to redeem the token P, Q, R, so user A will call redeem...

Can easily bypass the require by modifying parameter

Lines of code Vulnerability details Impact User can easily bypass the require code inside redeem function inside SimpleFeiDaiPSM.sol file by modifying the parameter. the requireamountFeiOut = minAmountOut, ... and requireamountOut = minAmountOut, .. statement can be bypassed easily since the two...

FEI Minter can drain SimpleFeiDaiPSM contract DAI balance

Lines of code Vulnerability details Impact The FEI token contract contain a mint function which allow the MINTER to mint a given amount of FEI tokens to any account including his own address. So the Minter can mint to his own account an amount of FEI tokens equivalent to the SimpleFeiDaiPSM...

User that uses auto compounding solution to auto compound cTokens and smart contracts that hold cTokens can't redeem their cTokens to FEI

Lines of code Vulnerability details Impact You mentioned that "Only EOA addresses will be listed in the merkle nodes, as addresses also need to perform an ECDSA signature on a message to claim the swap." This leaves any contract holding that cToken rugged. Moreover, not only contract Is rugged, b...

TribeRedeemer.redeem function can possibly revert when block gas limit is reached

Lines of code Vulnerability details Impact As the following constructor shows, when constructing the TribeRedeemer contract, the number of tokens in tokensReceived that is used to set tokensReceived is not capped. When the redeem function below is called, tokensReceived, which is essentially toke...

redeem() doesn't support inflationary or deflationary erc20 tokens

Lines of code Vulnerability details Impact A transfer-on-fee token or a deflationary/rebasing token, causes the received amount to be less than the accounted amount. For instance, a deflationary tokens might charge a certain fee for every transfer or transferFrom. TribeRedeemer.sol supports the u...

High Potential Redeem function can not be executed because of revert

Lines of code Vulnerability details Impact Inside TribeRedeemer constructor tokensReceived is initialized, and can't be modified anywhere else. previewRedeem function will check balance of tokensReceived tokens of TribeRedeemer contract, and there is a require statement which guarantees that the...

Exchange rate may stale.

Lines of code Vulnerability details Impact While deploying rarimarkleredeemer the deployer set exchange rate in constractor and this cant be change through any function so, while calculating the preview redeem it may use a difference exchange rate between the actuall ctoken and the exchange rate ...