Residual Allowance Might Allow Tokens In SetToken To Be Stolen

Lines of code Vulnerability details Proof-of-Concept Whenever mintFCashPosition function is called to mint new fCash position, the contract will call the approve function to set the allowance to maxSendAmount so that the fCash Wrapper contact can pull the payment tokens from the SetToken contract...

Users Might Not Be Able To Purchase Or Redeem SetToken

Lines of code Vulnerability details Proof-of-Concept Whenever a setToken is issued or redeemed, the moduleIssueHook and moduleRedeemHook will be triggered. These two hooks will in turn call the redeemMaturedPositions function to ensure that no matured fCash positions remain in the Set by redeemin...

Did Not Enforce Underlying To Be A Component Of SetToken Before Calling setRedeemToUnderlying

Lines of code Vulnerability details Proof-of-Concept Within the NotionalTradeModule.mintFCashPosition function, it will check if the sendToken submitted is a component of the SetToken before the minting process. Within the NotionalTradeModule.redeemFCashPosition function, it will check if the...

Too many setToken modules may cause gas limit error

Lines of code Vulnerability details Impact Too many setToken modules may cause gas limit error. Has these impacts: 1. These setToken can't be initialized in NotionalTradeModule 2. Cannot remove any module from that setToken Proof of Concept / @dev MANGER ONLY: Initialize given SetToken with initi...

Did Not Enforce fCash To Be A Component Of SetToken Before Minting

Lines of code Vulnerability details Proof-of-Concept Assume that the manager decided to add a fCash position called "Wrapped fDAI @ 10 October 2022", which will mature at 10 October 2022, to the SetToken. To do so, the manager will call the NotionalTradeModule.mintFCashPosition function. The...