onlyBurner modifier missing

Lines of code Vulnerability details Impact onlyBurner modifier is missing in burn function. Since it is a public function anyone can burn FEI tokens. Proof of Concept Tools Used Manual analysis Recommended Mitigation Steps Add onlyBurner modifier to the burn function. --- The text was updated...

setMinter() in vcon.sol missing important checks can lead to loss of minting ability

Lines of code Vulnerability details Impact The setMinter function in Vcon.sol lacks both zero address checks and a proper ownership transfer pattern. I am submitting this as a medium-severity issue separate from similar low-severity instances due to this example's effect on the entire protocol. I...

Facilitator fee is higher than it should be if loan asset has fees on transfer

Lines of code Vulnerability details Impact When the lend asset is a token with fees on transfer, the facilitator fee is higher than it should be. The contract doesn't use the actual token amount it received but the one where the fees aren't subtracted yet. This causes the borrower to receive fewe...

NonCustodialPSM.mint ignores mint buffer reduced amount, mostly disabling mint rate control

Lines of code Vulnerability details Impact VOLT minting rate control doesn't happen when RateLimited's doPartialAction is true as NonCustodialPSM doesn't use the returned amount value, minting the full amount even when it was reduced by current mint buffer size limitation. There are two issues wi...

NFTLoanFacilitator: Insufficient granularity allows for same-term loans to be accepted

Lines of code Vulnerability details Details & Impact It is possible for the calculated interest rate improvement to be zero if the existing interest rate is low enough ≤ 0.9% with 10% improvement rate. In such cases, lenders can compete to continually buyout each other with the same terms. The...

Borrower collateral can be stolen

Lines of code Vulnerability details Impact In case of collateral price fluctuation, lender can create a situation where borrower would be unable to repay the loan and lender could get hold of collateral Proof of Concept 1. User creates a loan request for duration 1 day and minimum amount as 0.1...

Updating rate limit for addresses restores their entire buffer amount

Lines of code Vulnerability details Impact When the bufferCap is updated for an address in updateAddress, the address's allowed buffer bufferStored is replenished to the entire bufferCap. The address could frontrun the updateAddress call and spend their entire buffer, then the buffer is replenish...

Users Can Bypass Emergency Restrictions on updateUserRewardState()

Lines of code Vulnerability details Impact The emergencyWithdraw function intends to withdraw their tokens regardless if they are locked up for any duration. This emergency must be triggered by the owner of the contract by calling triggerEmergencyWithdraw. A number of functions will revert when t...

Precision loss

Lines of code Vulnerability details Impact In line 729 of HolyPaladinToken.sol a huge precision loss occurs if dropDecreaseDuration is not a multiple of MONTH. In its current implementation dropDecreaseDuration / MONTH will get rounded down, which means that dropDecreaseDuration of 1 month and 29...

PaladinRewardReserve.sol may have potential bugs if it uses new tokens as rewards

Lines of code Vulnerability details Impact PaladinRewardReserve.sol may have potential bugs if it uses new tokens as rewards. Proof of Concept Currently, PaladinRewardReserve.sol has following behaviors: mappingaddress = bool public approvedSpenders does not store the info regarding which token i...

Malicious user can indefinitely freeze the funds of another user

Lines of code Vulnerability details Impact By design, a user's cooldown period is extended if they receive a transfer of hPal. The cooldown is extended based on the weight of the receiver's original balance and cooldown period compared to the sent amount and sender's cooldown period. Due to this...

Setting the minter address to address(0) can lead to breaking the contract set.

Lines of code Vulnerability details Impact The highlighted issue can lead to breaking the functionality of the contract set. Proof of Concept At certain set functions in the codebase, we are allowing setting the values to address0 or the case where old address = new address. This was observed in...

CoreCollection.setRoyaltyVault doesn't check royaltyVault.royaltyAsset against payableToken, resulting in potential permanent lock of payableTokens in royaltyVault

Lines of code Vulnerability details Impact Each CoreProxy is allowed to be associated with a RoyaltyVault, the latter which would be responsible for collecting minting fees and distributing to beneficiaries. Potential mismatch between token used in CoreProxy and RoyaltyVault might result in minti...

Initializer can be called many times and change critical parameters in an existing collection

Lines of code Vulnerability details Impact Anyone can create a collection so the owner is not a trusted actor. Someone can create a collection with a maxSupply and then call initialize again to increase it. Also, the creator can use it to change price and front-run a mint with an arbitrary bigger...

Non unique token ID might lead to collusion

Lines of code Vulnerability details Impact Token IDs are defined as concatenation of points, total supply + 1. The total supply can decrease when split process in progress. This means that the contract might try to mint a token with an ID which already exists. Proof of Concept 1. Navigate to the...

One co-creator with a small share can get 100% of the funds in the splitter

Lines of code Vulnerability details Impact One co-creator with a small share can get 100% of the funds by calling the incrementWindow function from an attacker contract that mimics RoyaltyVault. He can then create one or multiple fake windows and claim them to get the full balance of the splitter...

Wrong constant definition

Lines of code Vulnerability details Impact PERCENTAGESCALE in Splitter.sol is defined as 1e6 and this is not aligned with used percentage scale, which is an inverse of a basis point - 1e4. Contracts rely on the values displayed by external function of a contract. They may align a percentage to th...

Possible problem when mintToken and the user wants to purchase a token

Lines of code Vulnerability details Impact A User can mint tokens even if the payment doesn't succeed. Proof of Concept the contract ERC721Payable uses erc20 to handle payments. When this contract handles the payment of the user , calls the function transferFrom from the ERC20 payableToken variab...

Collection Owners Can Brick the CoreCollection.sol Contract by Preventing Token Transfers

Lines of code Vulnerability details Impact Joyn allows project owners to configure their own royalty vault or give the SplitFactory.sol contract the ability to do this when the Splitter.sol and RoyaltyVault.sol contracts are deployed. Because there is an option for the owner to control the...

DoS: Attacker May Front-Run CoreFactory.createProject() With A _projectId Causing Future Transactions With The Same _projectId to Revert

Lines of code Vulnerability details Impact A projectId may only be used once in CoreFactory.createProject since the modifier onlyAvailableProject will revert if project.creator != 0. The result is an attacker may front-run any createProject transaction in the mem pool and create another...