rounding error can lead to DISABLE the system

Lines of code Vulnerability details Impact In RNGAuction.sol, openSequenceId if the difference between currentTime and sequenceOffset is less than the sequencePeriod, it will round to zero leading to all functions depending on its value to return false like canStartNextSequence, or even revert in...

Inflation attack by token transfer

Lines of code Vulnerability details Impact The first staker can inflate the exchange rate by transferring tokens directly to the contract such that subsequent stakers get minted zero wxETH. Their stake can then be unstaked by the first staker, together with their own first stake and inflation...

Deflation bricking

Lines of code Vulnerability details Impact First staker can block staking by making exchangeRate == 0. Proof of Concept As can be seen function exchangeRate public view returns uint256 /// @dev if there are no tokens minted, return the initial exchange rate uint256 totalSupply = totalSupply; if...

SUSE CVE-2016-3630

The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a 1 clone, 2 push, or 3 pull command, related to a a list sizing rounding error and b short records...

SUSE CVE-2017-7619

In ImageMagick 7.0.4-9, an infinite loop can occur because of a floating-point rounding error in some of the color algorithms. This affects ModulateHSL, ModulateHCL, ModulateHCLp, ModulateHSB, ModulateHSI, ModulateHSV, ModulateHWB, ModulateLCHab, and ModulateLCHuv...

DIVISION BY _AMT_PER_SEC_MULTIPLIER AT EACH STEP OF THE ARITHMETIC OPERATION BEFORE MULTIPLICATION RESULTS IN ROUNDING ERROR

Lines of code Vulnerability details Impact In the drippedAmt function of the Drips.sol contract, the assembly is used to calculate the amount dripped over a time range. Inside the assembly amtPerCycle is calculated by multiplying cycleSecs and amtPerSec and dividing by AMTPERSECMULTIPLIER to remo...

First depositer exploit can break share calculation

Lines of code Vulnerability details Impact A well known attack vector for almost all shares based liquidity pool contracts, where an early user can manipulate the price per share and profit from late users' deposits because of the precision loss caused by the rather large value of price per share...

Rounding error in distribute() function

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The distribute function might suffer from serious rounding error since it calculates tokensPerShare that has a division rounding error, and then use uint256 transferAmt = tokensPerShare numberOfShares; ...

attacker can make stakeRate to be 1 in the StRSR contract and users depositing tokens can lose funds because of the big rounding error

Lines of code Vulnerability details Impact code calculates amount of stake token and rsr token based on stakeRate and if stakeRate was near 1e18 then division error is small but attacker can cause stakeRate to be 1 and that can cause users to loss up to 1e18 token during stake and unstake. Proof ...

Rounding error "confiscastes" some collateral

Lines of code Vulnerability details Impact There are no adjustments for collateral that is not returned on redemptions due to rounding errors. It will stay in the assetSender however, it will look as if was fully paid out. The rounding error also depends on the burned quantity, so it may be...

GroupBuys that are completely filled still don't raise stated target amount

Lines of code Vulnerability details Description createPool in GroupBuy.sol creates a new contribution pool around an NFT. It specifies a target initialPrice as minimum amount of ETH the NFT will cost, and totalSupply which is the number of Raes to be minted on purchase success. minBidPrices is...

previewWithdraw() in AutoPxGlp and AutoPxGmx doesn't rounds up when calculating corresponding shares for assets, even so they are overrides previewWithdraw() in PirexERC4626 which rounds up and withdraw() in all 3 contract assumes and depends on previewWithdraw() to rounds up

Lines of code Vulnerability details Impact Contracts AutoPxGlp and AutoPxGmx extends PirexERC4626 and function withdraw and previewWithdraw has been overridden in those contracts. withdraw uses function previewWithdraw to calculate number of shares need to burn for corresponding amount of assets...

user fund lose in deposit() of PirexERC4626 contract because A MALICIOUS EARLY USER/ATTACKER CAN MANIPULATE THE VAULT’S PRICEPERSHARE TO TAKE AN UNFAIR SHARE OF FUTURE USERS’ DEPOSITS

Lines of code Vulnerability details Impact This is a well-known attack vector for new contracts that utilize pricePerShare for accounting. Attacker can cause totalAssets / totalSupply ratio to go as high as he wants and then because of rounding error in convertToShares lower amount of share would...

A malicious early user/attacker can manipulate the pxGmx's pricePerShare to take an unfair share of future user's deposits

Lines of code Vulnerability details Impact An attacker/early user can deposit 1 wei in the vault and increase the price per share by sending a very high value of the underlying directly to the vault, causing next vault depositors to: not be able to deposit less than the very high share price set ...

rewards stuck in StakingRewards because of division rounding error in notifyRewardAmount() and rewardPerToken() and updateReward()

Lines of code Vulnerability details Impact In all functions notifyRewardAmount and rewardPerToken and updateReward there is a division which cause division rounding error and make some rewards to stuck in contract and users don't get their rewards and so users would lose funds. Proof of Concept...

Some of user funds stuck in contract because of division rounding error in beforeWithdraw()

Lines of code Vulnerability details Impact Function beforeWithdraw has been used in withdraw of Vault contract to calculates withdraw amount of users but because of division rounding error in this funds some user's funds would stuck in contract. Proof of Concept This is beforeWithdraw code:...

user fund loss in redeem() of RariMerkleRedeemer, because of division rounding error in previewRedeem() which is used in _redeem() and _multiRedeem()

Lines of code Vulnerability details Impact Because of the division rounding error in calculating baseToken amount, when users tries to redeem, they receive less baseToken for the amount of cToken they transferred to the RariMerkleRedeemer contract. This bug is more critical when cToken is a very...

Rounding error for low decimal token

Lines of code Vulnerability details Impact Some token has low decimal USDC has only 6, as a result, the rounding may introduce substantial error in stable pair calculation, causing wrong getAmountOut quote, at the end lead to fund loss in swap function. Malicious user can abuse the wrong quote to...

The vulnerability of the Apache Xalan Java XSLT library, related to a rounding error, allows attackers to execute arbitrary code.

The vulnerability of the Apache Xalan Java XSLT library is related to an error in converting integer values when processing XSLT style sheets. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

User fund lose in addLiquidity() of LiquidityReserve by increasing (totalLockedValue / totalSupply()) to very large number by attacker

Lines of code Vulnerability details Impact Function addLiquidity suppose to do add Liquidity for the staking Token and receive lrToken in exchange. to calculate amount of IrToken codes uses this calculation: amountToMint = amount lrFoxSupply / totalLockedValue but it's possible for attacker to...