Key transfer will destroy key if from==to

Handle kenzo Vulnerability details If calling transferFrom with from == recipient, the key will get destroyed meaning the key will be set as expired and set the owner's key to be 0. Impact A key manager or approved might accidently destroy user's token. Note: this requires user error and so I'm n...

Exploit for Path Traversal in Microsoft

CVE-2021-40444 PoC Malicious docx generator to exploit CVE-20...

No bound on marginRewardRate

Handle gzeon Vulnerability details Impact There is no check when setting marginRewardRate, if it is set to any value FixedPoint.ONE i.e. 1e18 it would lead to underflow at L403 Proof of Concept Recommended Mitigation Steps Add related check in setMarketInfo --- The text was updated successfully,...

Key buyers will not be able to get refund if lock manager withdraws profits

Handle kenzo Vulnerability details Unlock contains a feature in which a key buyer can ask for a refund. The refund is sent from the lock - where the purchase funds were sent. The lock manager can withdraw all funds from the lock. Therefore, if the lock manager withdraws enough profits from the...

Unbounded fee

Handle gzeon Vulnerability details Impact There is no check on the value of fee in OverlayV1Mothership.sol despite MINFEE and MAXFEE has been defined in L10. This issue is considered to be higher risk than the other because this enable the possibility for governance to "rug" users' fund by settin...

User can refund the received airdropped (free) "key"

Handle GiveMeTestEther Vulnerability details Impact User can refund the received airdropped free "key". If a lot of users received a airdropped "key" they can drain the funds of the lock. e.g. key owner cannot withdraw anything, user that purchased a key can't cancel and refund. Proof of Concept ...

Malicious user can DOS lock by falsely reaching maxNumberOfKeys using shareKey

Handle kenzo Vulnerability details A malicious user can call shareKey repeatedly, transferring miniscule amounts of his key to different accounts, thereby minting new keys until maxNumberOfKeys is reached. Impact Malicious user can grief and make lock purchasing become disabled. Proof of Concept ...

Fee double counting for underwater positions

Handle hyh Vulnerability details Impact Actual available fees are less than recorded. That's because a part of them corresponds to underwater positions, and will not have the correct amount stored with the contract: when calculation happens the fee is recorded first, then there is a check for...

isUnderwater returns opposite boolean for short positions

Handle harleythedog Vulnerability details Impact The function isUnderwater should return true iff the position value is 0. In the case of a short position, this is when oi 2 - priceFrame - debt 0 based on the logic given in the value function. Rearranging this equation, a short position is...

pow() is missing check on input parameters with 0 value

Handle gpersoon Vulnerability details Impact The contract LogExpMath.sol seems to be a fork of the balancer LogExpMath.sol contract. It is mostly similar, except for checks for x and y being 0 in the beginning of the function pow, see below. This omission might lead to unexpected results. Proof o...

Total Supply Does Not Change During the Burn/Mint

Handle defsec Vulnerability details Impact During the dynamic test, The Burn and Mint function does not increase/decrease total supply. That will cause liquidity loss on the protocol. Proof of Concept 1. Navigate to the following contracts. "" "" 2. Totalsupply is not adjusted according to...

CDP.sol update overwrites user's credit on every positive increment

Handle harleythedog Vulnerability details Impact Within CDP.sol there is a function called update. This function slowly decreases the debt of a position as yield is earned, until the debt is fully paid off, and the idea is then that the credit should begin incrementing as more yield is accumulate...

A user allowed to mint AlToken can mint an unlimited amount of it

Handle 0x0x0x Vulnerability details Impact A user with permission of minting can mint unlimited tokens. Proof of Concept We assume the user is allowed to mint, so the user is whitelisted, not blacklisted and ceilingmsg.sender 0. Furthermore, we assume that the contract is not paused. So when a us...

No slippage control on deposit of IbbtcVaultZap.sol

Handle gzeon Vulnerability details Impact There is no slippage control on deposit of IbbtcVaultZap.sol, which expose user to sandwich attack. Proof of Concept Any deposit can be sandwiched, especially when the pool is not balanced. Tools Used Recommended Mitigation Steps Add a minOut in line with...

VaderRouter._swap performs wrong swap

Handle cmichel Vulnerability details The 3-path hop in VaderRouter.swap is supposed to first swap foreign assets to native assets, and then the received native assets to different foreign assets again. The pool.swapnativeAmountIn, foreignAmountIn accepts the foreign amount as the second argument...

Newly Registered Assets Skew Consultation Results

Handle leastwood Vulnerability details Impact The TwapOracle.consult function iterates over all token pairs which belong to either VADER or USDV and then calculates the price of the respective asset by using both UniswapV2 and Chainlink price data. This helps to further protect against price...

Unbounded loops

Handle pauliax Vulnerability details Impact There are several loops in the contract which can eventually grow so large as to make future operations of the contract cost too much gas to fit in a block. Specifically, in contract TwapOracle there is no upper boundary on how many pairs can be...

XVader.sol : loss of user funds during 'leave' function

Handle shri4net Vulnerability details Impact Unintended Fee is charged to user while using 'leave' function in XVader.sol as part of the voting/governance. Proof of Concept Ref contracts/x-vader/XVader.sol, function leave Ref contracts/tokens/Vader.sol, function transfer Example, User locks 100...

All user assets which are approved to VaderPoolV2 may be stolen

Handle TomFrench Vulnerability details Impact Total loss of funds which have been approved on VaderPoolV2 Proof of Concept VaderPoolV2 allows minting of fungible LP tokens with the mintFungible function Crucially this function allows a user supplied value for from which specifies where the...

VaderRouter.calculateOutGivenIn calculates wrong swap

Handle cmichel Vulnerability details The 3-path hop in VaderRouter.calculateOutGivenIn is supposed to first swap foreign assets to native assets in pool0, and then the received native assets to different foreign assets again in pool1. The first argument of VaderMath.calculateSwapamountIn,...