Permanent lockup of tokens without recovery possible

Lines of code Vulnerability details Impact The callhook for whitelisted contracts adds an additional layer of complexity that can have multiple points of failure. If the execution of L2GraphTokenGateway.finalizeInboundTransfer fails indefinitely, there is currently no way to recover the...

[NAZ-M1] GraphTokenUpgradeable.permit() Should Always Check recoveredAddress != 0

Lines of code Vulnerability details Impact The GraphTokenUpgradeable.permit function ignores the recoveredAddress != 0 check if isApprovedForAllownerrecoveredAddress is true. If a user accidentally set the zero address as the operator, tokens can be stolen by anyone as a wrong signature yield...

Dont check return type

Lines of code Vulnerability details Impact Dont check return type Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Add suitable checks --- The text was updated successfully, but these errors were encountered: 👎 1 trust1995 reacted with thumbs down emoji All reactions 👎 1...

No check for zero address

Lines of code Vulnerability details Impact No check for zero address Proof of Concept Tools Used Recommended Mitigation Steps Add check for zero address for contractAddress inside there is not need to emit event if contract does not exist. --- The text was updated successfully, but these errors...

Assume that asset type passed from outside is valid

Lines of code Vulnerability details Impact Assume that asset type passed from outside is valid. Proof of Concept Tools Used Code analytics Recommended Mitigation Steps Better way is to case collection address to some interface, use method to obtain type. --- The text was updated successfully, but...

The buyer will lose their funds by "gas limit DoS via unbounded operations"

Lines of code Vulnerability details Impact If the buyer invoke execute he will lose their funds by gas limit DoS via unbounded operations Proof of Concept execute == executeFundsTransfer == transferFees In case, execute is called by the buyer ,and the seller set fees.length == 2^256-1 As we see...

Lack Of A Safety Mechanism For Deducting Selling Fees

Lines of code Vulnerability details Vulnerability Details The transferFees function of the BlurExchange contract calculates and transfers selling fees to multiple fee receivers as shown in L477 - 478 in code snippet 1. The selling fees would be deducted from the selling price. In other words, a...

ExecutionDelegate can approve arbitrary calling contract

Lines of code Vulnerability details Impact Owner can steal users' funds and tokens. Proof of Concept The owner of ExecutionDelegate can approve any contract to call it, e.g. a malicious contract which can then drain all funds and tokens approved by users to ExecutionDelegate. Users should only...

revokeApproval() only work with WETH

Lines of code Vulnerability details Impact User can invoke execute successfully even if revokedApprovalmsg.sender == true Proof of Concept If buyer did invoke revokeApproval it only block matching the orders if paymentToken == WETH but if the paymentToken == address0 the buyer could invoke execut...

Buyers will lose an amount of their funds for only one ERC115 token

Lines of code Vulnerability details Impact By using StandardPolicyERC1155.sol as a matchingPolicy for the order. The buyer will transfer an amount of funds ETH or WETH for 2 or more tokens, but he will receive only 1 token. Proof of Concept in case the buyer has set Input.Order.amount 1. Let’s sa...

Critical matching policy logic is unenforced

Lines of code Vulnerability details Impact Malicious order matching. Proof of Concept When being executed two orders are matched using custom matching policies. Certain checks are critical for every order matching. Currently these checks would have to be implemented in the matching policies...

Amount of ERC1155 tokens transferred is always 1.

Lines of code Vulnerability details Impact When a user signs an order to buy multiple ERC1155 tokens the amount of tokens transferred is hardcoded to be 1. This means although they expected to get n number of tokens for the total price of X they only get 1 and pay the total amount of X ETH. Proof...

Transfer reminder of msg.value is bad practice

Lines of code Vulnerability details Impact Transfer reminder of msg.value is bad practice. Can lead to out of gas, reentrancy and so on. Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Can create method getReminder and user to call to get all reminders for him. --- The...

Griefing of execute transaction sender

Lines of code Vulnerability details Description In function execute from BlurExchange contract there is a call of executeTokenTransfer function. The last one contains the following logic: function executeTokenTransfer address collection, address from, address to, uint256 tokenId, uint256 amount,...

The L1GraphTokenGateway does not work on non-standard compliant tokens like USDT

Lines of code Vulnerability details Vulnerability details The L1GraphTokenGateway function uses the standard IERC20 function for the transfer call and proceeds with a checkReturnCode function to handle non-standard compliant tokens that don't return a return value. However, this does not work as...

Type Error

Lines of code Vulnerability details Impact Type Error Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Foundry - Forge Recommended Mitigation Steps Consider changing uint to int and ...

Type safety issue in https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/libraries/FullMath.sol

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Tools Used Foundry - forge. Recommended Mitigation Steps change the ln. 59 to uint256 twos = typeuint256.max - denominator + 1 & denominator; --- The text was updated successfully, but...

AlgebraPoolDeployer.sol#L50-L51 : After the pool deployment, the memory of "parameters's" members are not cleaned.

Lines of code Vulnerability details Impact As the memory of previous members are not cleared, this can cause unexpected result when deploying subsequent pools. Proof of Concept. parameters = ParametersdataStorage: dataStorage, factory: factory, token0: token0, token1: token1; pool = addressnew...

AlgebraPool.sol#L501-L507 : position.fees are updated without checking whether the amount value is greater than zero or not

Lines of code Vulnerability details Impact Incorrect fee update if any one of the amount is zero. Proof of Concept if amount0 | amount1 != 0 position.fees0 = positionFees0 - amount0; position.fees1 = positionFees1 - amount1; if amount0 0 TransferHelper.safeTransfertoken0, recipient, amount0; if...

ArtGobbler can be abused to squirt more goo without providing any NFT

Lines of code Vulnerability details Impact Some ERC20 tokens don’t throw but just return false when a transfer fails. This can be abused to trick the gobble function to gobble without providing any valid art. A good example of such a token is ZRX: Etherscan code This issue can be abused by a...