Upgraded Q -> M from #658 [1674423108320]

Judge has assessed an item in Issue 658 as M risk. The relevant finding follows: L-05 MARGIN ASSET TOKENS WITH MORE THAN 18 DECIMALS ARE NOT SUPPORTED As shown below, arithmetic operations of the StableVault.deposit, StableVault.withdraw, Trading.handleDeposit, and Trading.handleWithdraw function...

ConduitController: Smart Contract Initial Owner Vulnerability

Lines of code Vulnerability details Bug Description The createConduit function in the ConduitController smart contract is responsible for deploying new conduits, or contracts that allow registered callers or open "channels" to transfer approved ERC20/721/1155 tokens on their behalf. The function...

Potential Manipulation Vulnerability in _validateOrdersAndPrepareToFulfill Function

Lines of code Vulnerability details Impact The smart contract may not be properly validated, which could lead to fraudulent or malicious orders being fulfilled. This could result in loss of assets or other financial damage to users of the contract. Additionally, if the validation process is not...

Out-of-Memory Exception in _performERC1155BatchTransfers Function Leading to Loss of Tokens.

Lines of code Vulnerability details Impact When the safeBatchTransferFrom function reverts, the code copies the revert data to memory in order to revert the transaction. However, the code does not properly handle memory allocation for this data, which could lead to an out-of-memory exception. If ...

Unhandled Revert in _performERC721Transfer Function Resulting in Loss of Tokens.

Lines of code Vulnerability details Impact transferFrom function is used to transfer ownership of ERC721 tokens from one address to another. If this function reverts, it means that the transfer failed, and the ownership of the tokens should not be changed. However, the code in the...

Missing require statement for sellAmount in init() function leading to potential loss of funds.

Lines of code Vulnerability details Impact init function is missing a require statement to check if the input variable sellAmount is less than or equal to the contract's balance of sell tokens. This means that the contract is allowing the user to initiate an auction with a sell amount greater tha...

Possible Unauthorized Redemption of Collateral ERC20 Tokens due to Lack of Proper Check in redeem() Function

Lines of code Vulnerability details Impact An attacker who is not authorized by the smart contract could potentially redeem more tokens than they are entitled to. This could cause a loss of funds for the smart contract and its users, as well as potentially destabilizing the overall ecosystem...

High Severity Reentrancy Vulnerability in stateTransition Modifier

Lines of code Vulnerability details Impact Lack of reentrancy protection in the stateTransition modifier occurs in the following line of code. modifier stateTransitionTradeStatus begin, TradeStatus end requirestatus == begin, "Invalid trade state"; status = TradeStatus.PENDING; ; assertstatus ==...

Wrong check isContract for Permit

Lines of code Vulnerability details Impact In function: requireSignature. The validation to check whether the msg.sender is a smart contract is not enough in this case. Anyone could bypass that check by calling that function from the constructor of a newly deployed contract. Therefore not the rig...

Lack of proper input validation in fulfillBasicOrder function.

Lines of code Vulnerability details Impact function fulfillBasicOrder BasicOrderParameters calldata parameters external payable returns bool fulfilled; fulfillBasicOrder function is designed to fulfill basic orders on the marketplace, however, the code provided does not clearly define what fields...

Overflow/Underflow in interest calculation caused by lack of timestamp validation in _getInterest() & _getRemainingInterest() function

Lines of code Vulnerability details Impact An attacker could manipulate the last timestamp of a lien in the stack struct to cause an underflow or overflow in the interest calculation. This could result in an incorrect interest amount being calculated, which could lead to incorrect payments being...

Infinite Loop Vulnerability in endIdForWithdraw() Function.

Lines of code Vulnerability details Impact While loop within the endIdForWithdraw function. while left time test = left + right / 2; // left test right because left right - 1 if queuetest.availableAt = time left = test; else right = test; This loop can cause an infinite loop if the loop invariant...

User can lose 10 ethers to Vault

Lines of code Vulnerability details Impact If a user or a contract that has a large allowance 10 ethers or max on an ERC4626Cloned based Vault that has not yet received any deposits, calls mint with 0 share argument, will have a 10 ethers of the asset transferred to the Vault with no way to recla...

Deny of service in CCash.sol with "transfer" which can be unusable for smart contract calls

Lines of code Vulnerability details Impact The CCash.doTransferOut method is susceptible to denial of service. Proof of Concept The logic of the doTransferOut method in CCash is as follows: The whole user withdraw is being handled with a token.transfer call. This is unsafe as transfer has hard...

Possiblity of storage collision

Lines of code Vulnerability details Impact There is a possibility of storage collision, when you upgrade the implementation contract in the . This could happen because the storage in the smart contract is stored the storage value from the left to the right, and if you add a new var to the storage...

An attacker can create a smart contract wallet with a malicious config and the address that the user expects his smart contract to have

Lines of code Vulnerability details Issue A deployCounterFactualWallet function in the SmartAccountFactory.sol uses create2 command to deploy a smart contract wallet with the address that can be computed before a transaction. A problem with the function is that it doesn't include the config...

Signature Replay Attack when EntryPoint contract is changed

Lines of code Vulnerability details Signature Replay Attack when EntryPoint contract is changed Impact User operations can be replayed on smart accounts once the EntryPoint is changed. This can lead to user's loosing funds or any unexpected behaviour that transaction replay attacks usually lead t...

The owner's address is not declared as payable

Lines of code Vulnerability details Impact If someone sends ether to the contract, it would be highly possible that the ether could be locked forever or never withdrawn by its intended recipientOwner Proof of Concept Tools Used Manual Recommended Mitigation Steps Add "payable" keyword to the owne...

Relayers can steal extra fees from smart contract wallets on every transaction

Lines of code Vulnerability details Impact Relayers can take signed transactions and append zeroes to the signature parameter to artificially increase the gas cost and startGas estimation. This causes additional cost for the signer and increases the relayers reimbursement. The cost/reimbursement...

Front-running "deployCounterFactualWallet"

Lines of code Vulnerability details Description The deployCounterFactualWallet function deploys a smart wallet using the create2 function with a salt value that depends on the owner and index parameters. However, the address derivation for the deployed wallet does not depend on the entryPoint and...