[ZZ-004] During the deprecation period where both .eth registrar controllers are active, a crafted hack can be launched and cause the same malicious consequences of [ZZ-001] even if [ZZ-001] is properly fixed

Severity: High Status: Has not been reported Description, Specifically, according to the documentation, there will be a deprecation period that two types of .eth registrar controllers are active. Names can be registered as normal using the current .eth registrar controller. However, the new .eth...

Griefing attack can prevent almost all activity in a pool

Handle harleythedog Vulnerability details Impact Consider the mint function in TimeswapPair.sol. The caller of this function is able to freely specify xIncrease, yIncrease and zIncrease. In particular, it is possible to specify xIncrease and zIncrease to be extremely small values e.g. 1 wei, whil...

_transferBurn does not actually burn tokens (decrease supply)

Handle harleythedog Vulnerability details Impact The implementation of transferBurn in ovl/OverlayToken.sol does not actually burn any tokens since totalSupply is not decreased see the implementation for burn for reference of what should be done. The transferBurn function is a helper function tha...