Users Can Bypass Emergency Restrictions on updateUserRewardState()

Lines of code Vulnerability details Impact The emergencyWithdraw function intends to withdraw their tokens regardless if they are locked up for any duration. This emergency must be triggered by the owner of the contract by calling triggerEmergencyWithdraw. A number of functions will revert when t...

Precision loss

Lines of code Vulnerability details Impact In line 729 of HolyPaladinToken.sol a huge precision loss occurs if dropDecreaseDuration is not a multiple of MONTH. In its current implementation dropDecreaseDuration / MONTH will get rounded down, which means that dropDecreaseDuration of 1 month and 29...

PaladinRewardReserve.sol may have potential bugs if it uses new tokens as rewards

Lines of code Vulnerability details Impact PaladinRewardReserve.sol may have potential bugs if it uses new tokens as rewards. Proof of Concept Currently, PaladinRewardReserve.sol has following behaviors: mappingaddress = bool public approvedSpenders does not store the info regarding which token i...

Malicious user can indefinitely freeze the funds of another user

Lines of code Vulnerability details Impact By design, a user's cooldown period is extended if they receive a transfer of hPal. The cooldown is extended based on the weight of the receiver's original balance and cooldown period compared to the sent amount and sender's cooldown period. Due to this...

Setting the minter address to address(0) can lead to breaking the contract set.

Lines of code Vulnerability details Impact The highlighted issue can lead to breaking the functionality of the contract set. Proof of Concept At certain set functions in the codebase, we are allowing setting the values to address0 or the case where old address = new address. This was observed in...

Initializer can be called many times and change critical parameters in an existing collection

Lines of code Vulnerability details Impact Anyone can create a collection so the owner is not a trusted actor. Someone can create a collection with a maxSupply and then call initialize again to increase it. Also, the creator can use it to change price and front-run a mint with an arbitrary bigger...

Non unique token ID might lead to collusion

Lines of code Vulnerability details Impact Token IDs are defined as concatenation of points, total supply + 1. The total supply can decrease when split process in progress. This means that the contract might try to mint a token with an ID which already exists. Proof of Concept 1. Navigate to the...

CoreCollection.setRoyaltyVault doesn't check royaltyVault.royaltyAsset against payableToken, resulting in potential permanent lock of payableTokens in royaltyVault

Lines of code Vulnerability details Impact Each CoreProxy is allowed to be associated with a RoyaltyVault, the latter which would be responsible for collecting minting fees and distributing to beneficiaries. Potential mismatch between token used in CoreProxy and RoyaltyVault might result in minti...

One co-creator with a small share can get 100% of the funds in the splitter

Lines of code Vulnerability details Impact One co-creator with a small share can get 100% of the funds by calling the incrementWindow function from an attacker contract that mimics RoyaltyVault. He can then create one or multiple fake windows and claim them to get the full balance of the splitter...

Collection Owners Can Brick the CoreCollection.sol Contract by Preventing Token Transfers

Lines of code Vulnerability details Impact Joyn allows project owners to configure their own royalty vault or give the SplitFactory.sol contract the ability to do this when the Splitter.sol and RoyaltyVault.sol contracts are deployed. Because there is an option for the owner to control the...

Wrong constant definition

Lines of code Vulnerability details Impact PERCENTAGESCALE in Splitter.sol is defined as 1e6 and this is not aligned with used percentage scale, which is an inverse of a basis point - 1e4. Contracts rely on the values displayed by external function of a contract. They may align a percentage to th...

Possible problem when mintToken and the user wants to purchase a token

Lines of code Vulnerability details Impact A User can mint tokens even if the payment doesn't succeed. Proof of Concept the contract ERC721Payable uses erc20 to handle payments. When this contract handles the payment of the user , calls the function transferFrom from the ERC20 payableToken variab...

Gas costs will likely result in any fees sent to the Splitter being economically unviable to recover.

Lines of code Vulnerability details Impact Collection owners will likely lose money by claiming fees unless the fees from a single NFT sale outweighs the cost of claiming it not guaranteed. Proof of Concept Consider a new Collection with a RoyaltyVault and Splitter set and a nonzero mint fee. Whe...

DoS: Attacker May Front-Run CoreFactory.createProject() With A _projectId Causing Future Transactions With The Same _projectId to Revert

Lines of code Vulnerability details Impact A projectId may only be used once in CoreFactory.createProject since the modifier onlyAvailableProject will revert if project.creator != 0. The result is an attacker may front-run any createProject transaction in the mem pool and create another...

LenderPool.terminate mix calculation between shares and tokens, resulting in incorrect amount of shares to be withdrawn from savings account

Lines of code Vulnerability details Impact While calculating the amount of shares to withdraw in LenderPool.terminate, principalWithdrawable which is amount of tokens is added to totalInterestInShares, and then passed to SAVINGSACCOUNT.withdrawShares. If tokens : shares are not 1 : 1, which is th...

Deposited collateral can't be withdrawn when PooledCreditLineStatus is Expired

Lines of code Vulnerability details Impact A user who deposits on an PooledCreditLineStatus.EXPIRED will not be able to withdraw the collateral Proof of Concept 1. Alice uses depositCollateral with 100 USDC on an Expired credit line - Here's the code 2. Alice attempts to use withdrawCollateral th...

Any user can recover the funds left in the contract

Lines of code Vulnerability details Impact There is a WithdrawFacet such that only the owner/admin can recover the lost funds in the contract. However, any user can retrieve the funds by using the swapTokensGeneric function, which might be unexpected behavior. Proof of Concept 1. Suppose that 100...

If contract holds balance of any ERC20 token, any user can take it

Lines of code Vulnerability details Impact If the LiFiDiamond contract ends up holding any ERC20 token, any user is able to perform a swap from the held asset to another asset, and the swap will use the contracts' funds as input instead of their own. The result is that a user can take all of the...

Fixed Amount of Gas Sent in Call May Be Insufficient

Lines of code Vulnerability details Impact The function attemptETHTransfer makes a call with a fixed amount of gas, 30,000. If the receiver is a contract this may be insufficient to process the receive function. As a result the user would be unable to receive funds from this function. Proof of...

Using payable.transfer functions in WithdrawFacet.sol and Libasset.sol is not usable for smart contract calls due to possible shortage of gas.

Lines of code Vulnerability details Impact Withdrawals and transferERC20 tokens are executed via transferERC20 and withdraw functions. Since these functions calls with a fixed amount of gas, it's not yet guaranteed to reach to the destination if the receiver is a smart contract. Proof of Concept...