Burning a User's Tokens for a Flash Proposal will not Deduct Their Balance

Handle kirk-baird Vulnerability details Impact The proposal to burn a user's tokens for a flash governance proposal does not result in the user losing any funds and may in fact unlock their funds sooner. Proof of Concept The function burnFlashGovernanceAsset will simply overwrite the user's state...

Use of deprecated Chainlink latestAnswer()

Handle sirhashalot Vulnerability details Impact Chainlink's documentation listed the latestAnswer function as deprecated. This function doesn't revert if no answer is available but returns 0, and the return value of latestanswer is not checked in the Notional code. In fact, Chainlink removed thei...

You can flip governance decisions without extending vote duration

Handle camden Vulnerability details Impact The impact here is that a user can, right at the end of the voting period, flip the decision without triggering the logic to extend the vote duration. The user doesn't even have to be very sophisticated: they can just send one vote in one transaction to ...

unwrap() can be called by anybody leading to loss of funds.

Handle GeekyLumberjack Vulnerability details Impact The caller of unwrap would receive all of the unwrapped convex tokens. Potentially depriving the user of all collateral and any rewards. Proof of Concept This portion of the readme describes the process that leads to the vulnerability. To repay ...

Malicious Users Can Transfer Vault Collateral To Other Accounts To Extract Additional Yield From The Protocol

Handle leastwood Vulnerability details Impact ConvexYieldWrapper.sol is a wrapper contract for staking convex tokens on the user's behalf, allowing them to earn rewards on their deposit. Users will interact with the Ladle.sol contract's batch function which: Approves Ladle to move the tokens...

Miscalculation of rewards due to removal of vaults

Handle hack3r-0m Vulnerability details Location: getDepositedBalance gives balance of account + collateralbalance of all vaults if a malicious party removes the vault of the usersince anyone can add/remove vaults of anyone if they are present in the cauldron before some critical action involving ...

Chainlink oracle query in _validateOrder does not check that response is fresh

Handle TomFrenchBlockchain Vulnerability details Impact Potential for TreasuryManager to use a stale price to calculate the slippage limit, allowing unacceptable slippage relative to if the price feed was current. Proof of Concept EIP1271Wallet queries Chainlink for the most recent price for...

OpenLevV1Lib's and LPool's doTransferOut functions call native payable.transfer, which can be unusable for smart contract calls

Handle hyh Vulnerability details Impact When OpenLev operations use a wrapped native token, the whole user withdraw is being handled with a payable.transfer call. This is unsafe as transfer has hard coded gas budget and can fail when the user is a smart contract. This way any programmatical usage...

The wrap and unwrap functions lack access control, allowing anyone to consume the convexToken in the contract

Handle cccz Vulnerability details Impact In the wrap and unwrap functions of the ConvexYieldWrapper contract, due to the lack of access control, anyone can consume the convexToken in the contract function wrapaddress to, address from external require!isShutdown, "shutdown"; uint256 amount =...

Unchecked transfers may lead to funds lost.

Handle bobi Vulnerability details Impact There are some transferFrom and transfer calls without checking the resultseg. against reverting. Moreover, for certain ERC20 tokens, should insufficient tokens be present, no revert occurs whatsoever, and instead, a "false" value is returned, which should...

transferFrom can return false, and didnt revert

Handle Tomio Vulnerability details Impact in the the user can create launchevent, and providing token to the launchevent contract, however, some token may behave differently when handling a failed transfer and transferFrom, some token may handle failed transfer and transferFrom by returning a fal...

Unchecked token transfers are used in LaunchEvent and RocketJoeFactory

Handle hyh Vulnerability details Impact For some ERC20 tokens no revert occurs but false is returned if transfer failed for any reason. If this isn't checked, the system will enter a wrong state with an accounted, but not executed transfer. This effect can pile up, messing the logic altogether...

Lack of input checks (withrawal penalties should always be greater than 0)

Handle pedroais Vulnerability details Impact If penalties are set to 0 the protocol would be vulnerable to price manipulations like the one described in the contest documentation. Proof of Concept The protocol uses economic penalties to punish withdraws to protect against economic price...

Sherlock: arbRestake() doesnt reduce addressShares of owner

Handle GreyArt Vulnerability details Impact As per the documentation, “After 2 weeks without action on an unlocked position arbs can come in to arbRestakeid, 20% of the underlying USDC amount principal + yield is at risk for the owner of the position.” While shares are redeemed for the arbitrager...

Owner can set arbitrary premium which allow nonStakers drain funds

Handle wuwe1 Vulnerability details Impact Owner can set arbitrary premium, this will cause protocol lose all the activeBalance, stakers lose all the claimable premium and nonStakers can drain all the usdc. Proof of Concept setProtocolPremium does not check the value of premium. premium can be...

Aiven Ltd: 0-day Cross Origin Request Forgery vulnerability in Grafana 8.x .

Disclaimer To triage, please note that this is still a 0-day that was alerted to Grafana already, in order to make sure the client is safe I report this issue now, please make sure to not spread it further or leak it, as the best interest is to let you be aware and safer from any potential attack...

Rocket.Chat: NoSQL-Injection discloses S3 File Upload URLs

Summary A NoSQL-Injection vulnerability in the getS3FileUrl Meteor server method can disclose arbitrary file upload URLs to users that should not be able to access. Description The fileId argument of the getS3FileUrl Meteor server method is not validated and can contain a regular expression. The...

transferTokenOut does not restrict withdraw to requested amount of token

Handle samruna Vulnerability details function transferTokensOutaddress receiver, uint256 amount internal // Transfers any premiums owed to stakers from the protocol manager to this contract sherlockProtocolManager.claimPremiumsForStakers; // The amount of tokens in this contract uint256 mainBalan...

Fund loss when insufficient call value to cover fee

Handle gzeon Vulnerability details Impact Fund can be lost if the L1 call value provided is insufficient to cover maxSubmissionCost, or stuck if insufficient to cover maxSubmissionCost + maxGas gasPriceBid. Proof of Concept outboundTransfer in L1LPTGateway does not check if the call value is...

Duplicate total in getMigrateUnbondingLocksParams

Handle 0x1f8b Vulnerability details Impact Wrong total computation. Proof of Concept The method getMigrateUnbondingLocksParams inside the contract L1Migrator doesn't check that the array unbondingLockIds provided by the user has duplicate ids, if the user provide duplicate ids the total will be...