Collateralization ratio manipulation can cause a denial of service

Lines of code Vulnerability details Impact Stablecoin redeeming and profit accruing in the SavingsVest contract can be blocked when the collateralization ratio has overflown. Proof of Concept The mitigation recommended in 31 and implemented by the sponsor in this commit doesn't resolve the root...

ARBITARY USER CAN CALL THE SavingsVest.accrue FUNCTION MULTIPLE TIMES BEFORE THE updateDelay PERIOD HAS ELAPSED

Lines of code Vulnerability details Impact In the SavingsVest contract the updateDelay variable is defined. This variable is used to refer the minimum time between two calls to the accrue function. This is implemented in the SavingsVest.accrue function as follows: if block.timestamp - lastUpdate...

Interest is not accrued before parameters are updated in SavingsVest

Lines of code Vulnerability details Impact Stablecoin holders can receive wrongly calculated yield in the SavingsVest contract. Also, wrong vesting profit can be slashed when the protocol is under-collateralized. Proof of Concept The SavingsVest contract lets users deposit their stablecoins and...

Read-only reentrancy is possible

Lines of code Vulnerability details Impact The agToken might be minted wrongly as rewards due to the reentrancy attack. Proof of Concept There are redeem/swap logics in the transmuter contract and all functions don't have a nonReentrant modifier. So the typical reentrancy attack is possible durin...