Incorrect Shift Operation

Lines of code Vulnerability details Impact There is an incorrect left shift operation in . The shift operation shl64, 1 would result in a value not equivalent to uint64 cast instead of value of 264 A left shift operation, x y is equivalent to the mathematical expression x 2y Proof of Concept...

ArtGobblers.sol#L396-L402 : The function "gobblerPrice()" does not check whether the mint has started or not

Lines of code Vulnerability details Impact This could revert due to undeflow. Proof of Concept While calculating the gobblerPrice, the function does not check whether the mintStart time is started or not. If it is future time, calling this could revert. This could affect the mintFromGoo function ...

User Might End Up Losing Preferred Gobblers to mint Legendary Gobbler

Lines of code Vulnerability details Impact mintLegendaryGobbler function of ArtGobblers.sol contract doesn't check whether user input parameter of gobblerIds is equal or more than the cost of legendary gobbler. It only check whether it is less than or not. Therefore it is possible for user to inp...

Lack of address check for contract ownership changes

Lines of code Vulnerability details Impact Not Checking for zero address input can cause to lose of ownership by accident . Proof of Concept owner try to change ownership to a zero address and it cause to lose of funds . Tools Used Recommended Mitigation Steps Add a check that address in not zero...

An attacker taking over the timelock_address or the owner address will result in DoS and unusable contract (frxETHMinter).

Lines of code Vulnerability details Impact Actions described in the POC result in DoS, if an attacker takes over one of the two "admin" addresses. Proof of Concept By taking over the timeLock or the owner address, the attacker will have access to the following functions moveWithheldETH,...

depositEther function DoS with locking funds

Lines of code Vulnerability details Description There is a depositEther function in frxETHMinter contract. The function performs multiple deposits to the depositContract. More detailed, the contract calculates the amount of ether that was submitted to it, and everything, except withheld amount, i...

Can overflow linear vest calculation and lock up funds

Lines of code Vulnerability details Impact If a Claim object for a user has a large enough vesting time and/or linear vesting amount, then that object can get into a state such that the calculations in baseVestedAmount overflow. If the baseVestedAmount calculations overflow, then the associated...

maxSupply_ fails to set a limit.

Lines of code Vulnerability details Impact In VariableSupplyERC20Token.sol maxSupply is used to set a limit to the amount mintable, and a value of 0 is used to represent an infinite limit. 0 is indeed a nonsensical value for this variable, and as such would be suitable to represent infinity, but...

Fee on transfer tokens can make users receive less than they are supposed to

Lines of code Vulnerability details Impact Some tokens take a transfer fee e.g. STA, PAXG. Tokens like these will be supported because the vested amount will be the amount that was actually transferred i.e. the balance of the contract after the transfer, but it will cause the user to receive less...

Admin Shouldn't Be Able to Withdraw Aleady Claimable Vested Token

Lines of code Vulnerability details Impact It is not ideal for admins to be able to withdraw any vested amount that is ALREADY claimable by vesting recipients to keep vesting recipient's or investors or employees incentives alligned with admins project. The point I want to say is that, current...

Overflow in amount calculation can lead to users not being able to withdraw their funds

Lines of code Vulnerability details Impact The amounts of token are saved in uint112 variables. The baseVestedAmount, which calculates the amount of token that was vested for the user given a timestamp, contains the following line that calculates the relative amount using the time passed from the...

Revoking claim should regard accrued but not claimed tokens

Lines of code Vulnerability details Impact revokeClaim should send the user what is already vested at this moment before deactivating the claim. e.g. imagine a situation when a user has never claimed the tokens and has 90% already vested but suddenly the admin decides to revoke it and the user is...

U.S. Dept Of Defense: External service interaction ( DNS and HTTP ) in www.████████

An External Service Interaction vulnerability was found in www.█████████, allowing an attacker to induce the application to interact with arbitrary external services such as DNS and HTTP. This could lead to various attacks, including DDoS, OS Command Injection, DOS, and Code Manipulation...

First depositor can break share minting

Lines of code Vulnerability details Impact Users will be unable to deposit their wished amount of tokens. Proof of Concept Similar to this ToB yearn audit, an attacker can mint a very small amount of shares and transfer a large amount of WETH to the contract, inflating the share price and making ...

Possible reentrancy attack on deposit function

Lines of code Vulnerability details Impact In deposit function the shares was calculated before the asset.safeTransferFrom. One possible scenario is when the supply it's 0totalSupplyid == 0, the retrun of convertToShares it's assets, if the asset is an ERC777 a contract sender could call again th...

Some of user funds stuck in contract because of division rounding error in beforeWithdraw()

Lines of code Vulnerability details Impact Function beforeWithdraw has been used in withdraw of Vault contract to calculates withdraw amount of users but because of division rounding error in this funds some user's funds would stuck in contract. Proof of Concept This is beforeWithdraw code:...

A malicious user could stuck crowdfund ETH

Lines of code Vulnerability details Impact A user could freeze funds accumulated in a crowdfund and execute a "fake sale" that would be the approval of the token. Proof of Concept A group of users create a crowdfund, they raise money to buy the most good looking Bored Ape. An attacker would buy i...

fee could round down to 0

Lines of code Vulnerability details Impact fee and memberSupply calculation will be inaccurate. Proof of Concept // contracts/distribution/TokenDistributor.sol 352-353: uint128 fee = supply args.feeBps / 1e4; uint128 memberSupply = supply - fee; When supply is low, fee could round down to 0, whic...

Chainlink's latestRoundData might return stale or incorrect results

Lines of code Vulnerability details Impact On Controller.sol and in PegOracle.sol we are using latestRoundData, but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation: Proof of Concept Tools Used Visual Inspection...

[NAZ-M1] No Storage Gap for Upgradeable Contract Might Lead to Storage Slot Collision

Lines of code Vulnerability details Impact For upgradeable contracts, there must be storage gap to "allow developers to freely add new state variables in the future without compromising the storage compatibility with existing deployments" quote OpenZeppelin. Otherwise it may be very difficult to...