Replay attack for authorized orders

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Nonce is used by sellers and buyers to avoid replay attack for their orders. However, since sellHash and buyHash only contain the order info and the nonce, it is still possible to have a replay attack...

Unlimited length of LineOfCredit.ids: out of gas

Lines of code Vulnerability details Impact There are no restrictions for ids length But there are many loops through ids. So if length will be bigger then some max value, loops may fail because of consuming all gas Proof of Concept Functions LineOfCredit.updateOutstandingDebt and...

Borrower's principal can be enormous due to underflow

Lines of code Vulnerability details Impact The lender and the borrower can repay borrower's debt using unusedTokens in SpigotedLine.useAndRepay function. The repay amount can be as much as unusedTokenscredit.token in SpigotedLine.useAndRepay143. The actual repay is handled in CreditLib.repay, and...

LineLib.sendOutTokenOrETH() may not be compatible with contract receiver because of use of transfer()

Lines of code Vulnerability details Impact LineLib.sendOutTokenOrETH may revert when its receiver is a contract, preventing it from receiving ETH, and thus from much of the functionality of the protocol. Proof of Concept LineLib.sendOutTokenOrETH is as follows. / @notice - Send ETH or ERC20 token...

The execute() function of SeaportProxy.sol will always fail.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. While L69 of SeaportProxy.sol is successful in preventing the function being called by a contract other than the LooksRareAggregator, unfortunately, the current implementation will fail the calling from...

Users are unable to revoke consents

Lines of code Vulnerability details Impact Neither lenders nor borrowers can revoke mutualConsents. This can pose an issue if a lender has given consent to lend funds but a borrower has proven untrustworthy either through actions in another credit line or some other public way. A lender should be...

Wrong marketplace address in SeaportProxy.sol

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The marketplace variable in SeaportProxy was initialized in the constructor, however since SeaportProxy will only be used in a delegatecall, such initialization in the constructor will be useless as it...

Reentrancy in _close() allows single lender to steal all deposits from other lenders

Lines of code Vulnerability details Impact Upon calling close, a lender's credit position is deleted AFTER the transfer out of their deposit. Therefore, an ERC777 will allow the lender to call close again and receive the same amount of funds. The lender will be able to reenter the contract as man...

Not possible to DiamondCut in frozen status

Lines of code Vulnerability details Impact DiamondCut's executeDiamondCutProposal executes the proposed diamondCut calldata in the Diamond is unfrozen condition. However, if there are any possible situations that require restriction implementation in which the upgrade should be executed in a froz...

L2 deposits might be reverted

Lines of code Vulnerability details Impact L1ERC20Bridge and L1EthBridge contracts have claimFailedDeposit function to withdraw funds from the initiated deposit, which failed when finalizing on L2. However, if the caller is allowed in senderCanCallFunction modifier, this function can be used to...

Denial of service from malicious bidder by filling up the bid index up until 1000

Lines of code Vulnerability details Impact Denial of service from malicious bidder by filling up the bid index up until 1000 Proof of Concept Initially inside bid function there is a check condition if bidIndex = 1000 then it will revert, so this will limit the size of bid created by bidder to...

A bidder can buy baseToken with low price by exploiting the DOS prevention measure

Lines of code Vulnerability details Impact In order to prevent DOS attacks, the smart contract introduces a measure that limits the number of bids on an auction SizeSealed.solL157-L159. However, an attacker/bidder can exploit this measure to block others to place bids so that the attacker can buy...

Funds can be stolen

Lines of code Vulnerability details Impact For L2, any deposit finalization should come from L1 bridge address. Now the MailBox contract is currently helping to simulate such calls to be coming from L1. The problem is if within zkSync ecosystem, a contract is deployed with address same as L1 brid...

msg.sender token balance is not checked before calling safeTransferFrom function

Lines of code Vulnerability details Impact createAuction FUNCTION and bid FUNCTION: Without checking the msg.sender token balance the transfer function may be failed to transfer token from msg.sender to contract address . this may cause a transactions failures. Same instance in 2 times PROOF OF...

Wrong bidIndex calculation

Lines of code Vulnerability details Impact Return wrong bidIndex Proof of Concept SizeSealed.sol Tools Used Manual Recommended Mitigation Steps uint256 bidIndex = a.bids.length - 1 ; --- The text was updated successfully, but these errors were encountered: 👎 1 trust1995 reacted with thumbs down...

Some cases maybe cause the bids unable to get their funds back.

Lines of code Vulnerability details Impact All of the following there cases maybe cause the bids unable to get their funds back. Details case1: If sellerwho is a bad man does not reveal in the reveal period, then all the bids will be unable to get their funds back. case2: If sellerwho is a bad ma...

initializer modifier on constructor function

Lines of code Vulnerability details Impact In L2StandardERC20.sol the initializer modifier is placed both on the constructor function and on the bridgeInitialize function. When the initializer modifier is used it cannot be called again on any function in the contract since it will revert with a...

Putting a word in quotes and having the > character in the summary allows scripts to execute

h3. Issue Summary If you have a summary with a word in double quotes, similar to "Something" and have the character. Then you can execute actions through tags in the summary This is reproducible on Data Center: Yes h3. Steps to Reproduce This can be reproduced when editing and creating an issue...

SimpleERC20Escrow's initialize() can be frontrun

Lines of code Vulnerability details Impact The user's collateral is not held in the market contract but is instead held in individual escrows. Every user has a unique escrow for every market. And the escrow contracts are created via the Market contract's createEscrow function. And it's initialize...

Deprecated ChainLink API

Lines of code Vulnerability details Impact According to Chainlink's documentation, the latestAnswer function is deprecated. This function might suddenly stop working if Chainlink stop supporting deprecated APIs. And the old API can return stale data. Proof of Concept function latestAnswer externa...