[H-02] Owner does not get any fee when call is expired

Lines of code Vulnerability details Owner\creators lose profit by not collecting the fees on half the expired cases all calls. The only place where owner receives fee is when withdrawing an exercised call or expired put: But when a call expired, no fee has been collected on any part of the order...

Admin Can Broke All Functionality Through Weth Address

Lines of code Vulnerability details Impact On the protocol, almost all functionality is constructed through WETH address. however, If the admin is set to WETH address mistakenly, user could not claim through . Admin can break the protocol. Proof of Concept Tools Used Code Review Recommended...

Total Cash Prior Is not Considered On the Exchange Rate

Lines of code Vulnerability details Impact Cash prior is not considered on the exchangeRateStoredInternal calculation. Even if Its declared as "value can be zero", the getCashPrior function is still defined on the contract. Proof of Concept Tools Used Code Review Recommended Mitigation Steps...

Contract TresureDelegate.sol could be destructed

Lines of code Vulnerability details Impact The contract simply could be destructed by anyone. Proof of Concept The question is how?! Imagine, that the recipient account has a fallback function with a selfdestruct in it. ./attack.sol contract attack fallback external payable...

GovernorBravoDelegate.sol _initiate() can be called multiple times

Lines of code Vulnerability details Submitting as med risk because documentation inside functions shows that require is there for the purpose of preventing it being called again but is not working correctly, and since we do not have access to the timelock code I cannot fully assess the impact...

Non view function is called with staticcall in CErc20Delegator

Lines of code Vulnerability details Impact When using CToken implementation with CErc20Delegator, the functions borrowRatePerBlock and supplyRatePerBlock will revert when the underlying functions try to update some states. Detail The v1 of borrowRatePerBlock and supplyRatePerBlock were view...

period size is incorrectly set

Lines of code Vulnerability details Impact Instead of setting periodSize to 1800 30 min, it is currently set to 0 which means new observations will get added each time update is called at BaseV1-core.solL166 Proof of Concept 1. Observe that periodSize is set to 0 2. BaseV1-core.solL166 will alway...

redeemFresh does not work

Lines of code Vulnerability details Impact The CNote contract uses the CToken contract's redeemFresh function to perform redeem operations. However, since the CNote contract does not hold note tokens, the getCashPrior returns 0 and is less than the redeemAmount, causing the redeemFresh function t...

BURNER_ROLE can burn any amount of ERC20MinterBurnerDecimals from an arbitrary address

Lines of code Vulnerability details Vulnerability details Proof of Concept Using the burnCoins function of ERC20MinterBurnerDecimals, an address with BURNERROLE can burn an arbitrary amount of tokens from any address. We believe this is unnecessary and poses a serious centralization risk. A...

Deny of service in CNote.doTransferOut

Lines of code Vulnerability details Impact The CNote.doTransferOut method is susceptible to denial of service. Proof of Concept The logic of the doTransferOut method in CNote is as follows: function doTransferOutaddress payable to, uint amount virtual override internal requireaddressaccountant !=...

borrowFresh does not work

Lines of code Vulnerability details Impact The CNote contract uses the borrowFresh function of the CToken contract to perform the borrow operation. However, since the CNote contract does not hold note tokens, getCashPrior returns 0 and is less than borrowAmount, making the borrowFresh function no...

Stored Cross-Site Scripting vulnerability in Recipe Instructions allows Admin session hijacking

Description A low privilege user can insert malicious JavaScript code into the Recipe Instructions which will execute in another person's browser that visits the recipe. Proof of Concept Reproduction Steps: 1. As a lower privileged user login to the Mealie web application. 2. Create a recipe and...

rwrvw

Lines of code L1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Stepsveqv --...

TEST

Lines of code testL1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --...

HTTP compression denial of service

curl supports "chained" HTTP compression algorithms, meaning that a server response can be compressed multiple times and potentially with different algorithms. The number of acceptable "links" in this "decompression chain" was unbounded, allowing a malicious server to insert a virtually unlimited...

Upgraded Q -> H from 215 [1656255310294]

Judge has assessed an item in Issue 215 as High risk. The relevant finding follows: L-09 wfCashERC4626 contract does not conform to EIP4626 Description The wfCashERC4626 contract implements the EIP4626 standard EIP-4626: Tokenized Vault Standard. However, according to EIP4626, the below-mentioned...

Transfer the original underlying token back to the user but actually transfer from lender to redeemer

Lines of code Vulnerability details Impact Transfer the original underlying token back to the user but actually transfer from lender to redeemer. Underlying token may be locked forever and user may not receive their fund after redeeming. Proof of Concept // Transfer the original underlying token...

Upgraded Q -> H from 104 [1656255316696]

Judge has assessed an item in Issue 104 as High risk. The relevant finding follows: L02: Incompatibility with ERC-4626 Line References Description The EIP-4626 specification requires that totalAssets to NOT revert, but the current implementation does so in the underlying methods: int256...

[H-05] Not minting iPTs for lenders in several lend functions

Lines of code Vulnerability details Impact Using any of the lend function mentioned, will result in loss of funds to the lender - as the funds are transferred from them but no iPTs are sent back to them! Basically making lending via these external PTs unusable. Proof of Concept There is no mintin...

[M-01] Cannot set or change curve pool after initialization

Lines of code Vulnerability details Impact Inability to set or change curve pool after initialization will hurt the project liquidity and block the ability to instant unstake from curve. Approving the CURVEPOOL address is done only on initialize and only if non zero address supplied. When using...