mintSynth and mintFungible function are not verified from==msg.sender

Handle cccz Vulnerability details Impact The mintSynth function and the mintFungible function are not verified from==msg.sender, causing anyone to use other people’s tokens to mint Synth or LP tokens for themselves Proof of Concept Tools Used Manual analysis Recommended Mitigation Steps Add the...

NFTXMarketplaceZap: Balance check can result in DOS

Handle GreyArt Vulnerability details Impact The mint721 and mint1155 functions check that the correct number of vault tokens have been minted, after accounting for mint fees. uint256 balance = count BASE - INFTXVaultvault.mintFeecount; requirebalance == IERC20Upgradeablevault.balanceOfaddressthis...

Griefing attack is possible as NFTXStakingZap, PalmNFTXStakingZap, NFTXMarketplaceZap rely on zero vault token balance for LP and minting

Handle hyh Vulnerability details Impact NFTXStakingZap and PalmNFTXStakingZap liquidity provision and NFTXMarketplaceZap minting will be blocked as addLiquidity and mint functions will revert all the time. An attacker can transfer a tiny amount of vault tokens to NFTXStakingZap/PalmNFTXStakingZap...

Wrong lastBuyBackPrice

Handle cmichel Vulnerability details The sYETIToken.lastBuyBackPrice is set in buyBack and hardcoded as: function buyBackaddress routerAddress, uint256 YUSDToSell, uint256 YETIOutMin, address memory path external onlyOwner requireYUSDToSell 0, "Zero amount"; requirelastBuybackTime + 69 hours...

Low-level call return value not checked

Handle cmichel Vulnerability details The NFTXStakingZap.addLiquidity721ETHTo function performs a low-level .call in payableto.callvalue: msg.value-amountEth but does not check the return value if the call succeeded. Impact If the call fails, the refunds did not succeed and the caller will lose al...

Duplicate Collateral could cause financial instability

Handle csanuragjain Vulnerability details Impact Duplicate collaterals can be added which makes getValidCollateral return duplicate items. This impacts all function which uses getValidCollateral function like getPendingCollRewards, which will now calculate the pending reward twice for the duplica...

Unwhitelisted token can cause disaster

Handle csanuragjain Vulnerability details Impact Contract instability and financial loss. This will happen if one of the allowed contract calls sendCollaterals with non whitelisted token may happen with user input on allowed contract Proof of Concept 1. Navigate to contract at 2. Assume...

Return variable can remain unassigned in _sendForReceiver

Handle sirhashalot Vulnerability details Impact The sendForReceiver function only sets a return function in the "if" code block, not the "else" case. If the "else" case is true, no value is returned. The result of this oversight is that the sendForReceiver function called from the distribute...

WJLP contract doesn't check for JOE and JLP token transfers success

Handle hyh Vulnerability details Impact Transactions will not be reverted on failed transfer call, setting system state as if it was successful. This will lead to wrong state accounting down the road with a wide spectrum of possible consequences. Proof of Concept safeJoeTransfer do not check for...

SingleNativeTokenExitV2 doesn't take input deadline to consideration

Handle kenzo Vulnerability details SingleNativeTokenExitV2 takes as input from the user a deadline for the trades. However, it does not use this input for the actual trade but sets the deadline to be block.timestamp. Impact Trades will not work as expected. User might set a deadline for the trade...

User created baskets are owned by defaultController

Handle 0x0x0x Vulnerability details User created baskets are owned by defaultController and help from the defaultController is needed to use any functionality or setup the basket. In test simply one account is used, but when a user wants to create a basket, they can’t control it properly...

Dishonest Stakers Can Siphon Rewards From xToken Holders Through The deposit Function In NFTXInventoryStaking

Handle leastwood Vulnerability details Impact xTokens is intended to be a representation of staked vault tokens. As the protocol's vaults accrue fees from users, these fees are intended to be distributed to users in an inconsistent fashion. NFTXInventoryStaking is one of the ways users can stake...

Owner of the BasketFacet can cause DoS for exitPool(...) function

Handle Czar102 Vulnerability details Impact Provided an owner can add any tokens to the basket, it may add a token, for which the owner can burn tokens from any account. Then, after adding the token to the basket, the owner may burn tokens so that token.balanceofBasketFacet will be below MINAMOUN...

_mint721() function can be broken because of strict equality check on token balance

Handle jayjonah8 Vulnerability details Impact In NFTXMarketplaceZap.sol the mint721 function has a require check that the balance must be equal to the amount of vault tokens in the contract. uint256 balance = count BASE - count INFTXVaultvault.mintFee; requirebalance ==...

UNIVERGE DT Series vulnerable to missing encryption of sensitive data

Overview UNIVERGE IP Phone DT Series and PC tools for DT Series maintainers IP Phone Manager and Data Maintenance Tool provided by NEC Platforms, Ltd. contain a missing encryption vulnerability CWE-311. NEC Platforms, Ltd. reported this vulnerability to IPA to notify users of its solutions throug...

User can lose Funds

Handle csanuragjain Vulnerability details Impact User funds lost Proof of Concept 1. Navigate to contract at 2. User joins a pool having 5 tokens in the basket by using joinPool function 3. Owner decides to remove 1 of the token from the basket 4. User exits the pool by calling exitPool function...

sendAllocatedYETI() can be called by anyone

Handle jayjonah8 Vulnerability details Impact In TeamAllocation.sol, the sendAllocatedYETI function simply distributes YETI to the team. This is a transfer of value and it currently can be called by anyone as the onlyTeam modifier is not used here. Proof of Concept Tools Used Manual code review...

U.S. Dept Of Defense: Log4Shell: RCE 0-day exploit on █████████

Hi team, log4 shell is recent 0-day exploit it's Java package vulnerable. ██████████ domain is vulnerable Impact RCE System Hosts █████████ Affected Products and Versions CVE Numbers CVE-2021-44228 Steps to Reproduce 1. Go to this url =...

buyAndSwap1155WETH() function may cause loss of user assets

Handle cccz Vulnerability details Impact In the NFTXMarketplaceZap.sol contract, the buyAndSwap1155WETH function uses the WETH provided by the user to exchange VaultToken, but when executing the buyVaultToken method, msg.value is used instead of maxWethIn. Since msg.value is 0, the call will fail...

Users Can Siphon AaveYield Rewards By Depositing And Withdrawing Collateral

Handle leastwood Vulnerability details Impact The AaveYield contract provides users with the option to choose Aave as their strategy of choice to generate yield. Users will make deposits to this strategy via the SavingsAccount contract. Upon deposit, shares are minted at a 1:1 exchange rate and t...