Function may fail when called due to the imprecise length of arrays to be looped (initialize function)

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Even though the array is calldata, there are...

Chainlink oracle data feed is not further validated and can return stale answer

Lines of code Vulnerability details Impact Although the protocol recognizes that Chainlink oracles can provide outdated answers, using stale answers without further validation might not be a good practice. Moreover, in the updateExchangeRate function, where the latestRoundData method is used, the...

repayAsset() but you will not receive your Collateral

Lines of code Vulnerability details Impact The user will just pay down the debt Proof of Concept By invoking repayAsset you will just pay the Asset Token, on the other hand, he does not send any amount of my Collateral Recommended Mitigation Steps Add a function to send the Collateral after...

How to capture a full memory dump from a PVS target running on Azure

This article will cover the steps necessary to prepare an Azure VM running PVS to be able to capture a full memory dump...

Exposure of critical functions

Lines of code Vulnerability details Impact AdminRole mixin exposes critical functions without any restrictions like grantAdmin revokeAdmin Proof of Concept Criticial functions like grantAdmin can be externally accessed changing the critical roles like admin. // for eg: function grantAdminaddress...

Functions quitLock and delegate fundamentally change game theory of VoteEscrow

Lines of code Vulnerability details Impact Without delegation it is not possible to remove voting power before the end of a lock. Function quitLock now makes this possible, but it does not just affect the user who quits the lock. Any votes that are delegated to them are temporarily lost from the...

VotingEscrow Owner Can Give Power to Force Undelegate

Lines of code Vulnerability details Impact As the owner can change the blocklist to anything, a malicious or compromised owner has the ability to set blocklist to an EOA which could directly call forceUndelegate on any number of users. This could be used in bad faith to distort voting. Recommende...

Wrong values are passed to _checkpoint mess up accounting

Lines of code Vulnerability details Impact The increaseUnlockTime function sends a wrong unlock time to the checkpoint function in the oldLocked variable - the locked variable which is the new LockedBalance is copied into the oldLocked variable which is supposed to be the previous LockedBalance,...

Delegators can Avoid Lock Commitments if they can Reliably get Themselves Blocked when Needed

Lines of code Vulnerability details Impact Users can enjoy the voting power of long lock times whilst not committing their tokens. This could cause the entire system to break down as the incentives don't work any more. Exploit Method This exploit only works if a user is able to use the system and...

VotingEscrow Ownership Management Lacks Basic Protections

Lines of code Vulnerability details Impact A comment saying "Owner should always be a timelock contract" is not sufficient protection for something as critical as ownership. There should be: a zero address check on addr a propose/transfer method of ownership transfer, not a unilateral transfer...

wrong calculation in MarketFees._getFees

Lines of code Vulnerability details Impact when calculating the royalty the loop start with 1 so creatorShares0 is skipped and not correctly converted his share so he can get more royalty than others creators Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots,...

VotingEscrow.increaseUnlockTime() uses wrong unlock time for old lock.

Lines of code Vulnerability details Impact VotingEscrow.increaseUnlockTime uses wrong unlock time for old lock. The user's voting power might be calculated wrongly. Proof of Concept As we can see from CheckpointMath, the oldLock.end should be original value but it uses the increased unlocktime...

Unsafe use of transfer()/transferFrom() with IERC20

Lines of code Vulnerability details Impact Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's transfer and transferFrom functions do not return booleans as the specification requires, and instead have n...

User can have full voting power with virtually no lockup using multiple locks and delegation

Lines of code Vulnerability details Impact User receives voting power of max lock but only locks for a minimal amount of time Proof of Concept In VotingEscrow.solcheckpoint, the duration of the delegatee and the total delegated tokens are used to determine the amount of voting power that a lock...

Friday Squid Blogging: SQUID Acronym for Making Conscious Choices

I think the U is forced: SQUID consists of five steps: Stop, Question, Understand, Imagine, and Decide. As usual, you can also use this squid post to talk about the security stories in the news that I havent covered. Read my blog posting guidelines here...

Take over of AdminRole contract

Lines of code Vulnerability details Impact Any user can call the grantAdmin or revokeAdmin method and take control of the contract. Proof of Concept The grantAdmin and revokeAdmin methods are not protected by any type of authentication restriction, when they should have the onlyAdmin modifier. So...

Registry.sol works bad - it fails to delivere expected functionality

Lines of code Vulnerability details Impact The description of Registry.sol is following: /// Deploys new proxies via the factory and keeps a registry of owners to proxies. Owners can only /// have one proxy at a time. But it is not. There are multiple problems: 1. Proxy owner can change and will...

MIMOProxy.sol can change owner, but not all contracts expect it. Registry.getCurrentProxy() can give wrong outputs.

Lines of code Vulnerability details Impact Registry.getCurrentProxy is expected to return the individual Proxy.sol for a user EOA. But Proxy.sol can change its owner, and Registry will not know it. Thus Registry.getCurrentProxy only show a deployers, and it means nothing for the project. Also,...

Manager is able to use swapData.dexTxData to Perform Reentrancy

Lines of code Vulnerability details Impact Reentrancy here allows a manager to perform multiple operations on a given pool beyond the max limit. Proof of Concept A Manager, using swapData.dexTxData, can reenter MIMO actions performed on the vault he is managing. The manager deploys a FAKE token a...

Malicious delegated contractor can block funding tasks or mark tasks as complete

Lines of code Vulnerability details Impact A malicious delegated contractor can add a huge number of tasks or one task with a huge cost. This would then pose problems in allocateFunds as tasks could not be funded. Builder could remove delegation for the contractor but couldn't replace the...