Attacker can cause loss to rToken holders and stakers by running BackingManager._manageTokens before rewards are claimed

Lines of code Vulnerability details Impact The assets that back the rTokens are held by the BackingManager and can earn rewards. The rewards can be claimed via the TradingP1.claimRewards and TradingP1.claimRewardsSingle function. The BackingManager inherits from TradingP1 and therefore the above...

Early attacker can DOS rToken issuance

Lines of code Vulnerability details Impact An early attacker can DOS the issue functionality in the RToken contract. No issuances can be made. And the DOS cannot be recovered from. It is permanent. Proof of Concept You can add the following test to the Furnace.test.ts file and execute it with yar...

User funds can be locked in RToken contract for a long time

Lines of code Vulnerability details Impact Unnecessary delay on the first issuance will lock the first issuer's deposit and other following deposits. Proof of Concept Users can issue new RTokens by depositing the necessary collaterals. The protocol is designed to limit issuance by some rate and t...

RecollateralizationLib: Flaw in basket range calculation leads to early basket compromise and loss to RToken holders

Lines of code Vulnerability details Impact This report deals with how the recollateralization algorithm underestimates the number of baskets it can hold by calculating unnecessary costs for collateral that does not need to be traded. When this number of baskets it thinks it can hold is reached -...

Fee on transfer based collateral is not considered.

Lines of code Vulnerability details Impact It has following impacts. 1. backingManager would be transferred with lesser than deposits 2. Recorded liabilities will be more 3. collateral deposited into the RToken contract would be lesser than deposits Proof of Concept Any one can mint RToken by...

RToken issuers are not protected from slippage

Lines of code Vulnerability details Impact Users can get loss from the slippage due to various potential reasons. Proof of Concept Users can issue new RTokens by depositing the necessary collaterals using the function issue. The function issue has two parameters specifying the recipient and...

Baited by redemption during undercollateralization (no issuance, just transfer)

Lines of code Vulnerability details Impact This is similar to the "high" vulnerability I submitted, but also shows a similar exploit can be done if a user isn't a whale, and isn't issuing anything. A user can send a redeem TX and an evil actor can make it so they get almost nothing back during...

early user can call issue() and then melt() to increase basketsNeeded to supply ratio to its maximum value and then melt() won't work and contract contract features like issue() won't work

Lines of code Vulnerability details Impact Function melt melt a quantity of RToken from the caller's account, increasing the basket rate. basket rate should be between 1e9 and 1e27 and function requireValidBUExchangeRate checks that if it's not in interval the the code would revert. the call to...