Not reverting on failing ERC20 transfer

Handle Sherlock Vulnerability details Impact In the Visor.sol contract an IERC20 transferFrom with an arbitrary token argument is used. The return value of the transferFrom is not used, a boolean indicating if the transaction succeeded. Meaning the transaction could succeed without the actual...

_sendForReceiver is vulnerable to reentrancy. This enables a receiver to drain the remaining fees to distribute.

Handle janbro Vulnerability details Summary sendForReceiver is vulnerable to reentrancy. This enables a receiver to drain the remaining fees to distribute. Risk Rating Critical Vulnerability Details NFTXFeeDistributor.sol Line 163: bool success, bytes memory returnData =...

Missing access restriction on NFTXVaultUpgradeable.finalizeFund

Handle @cmichelio Vulnerability details Vulnerability Details Missing access restriction on NFTXVaultUpgradeable.finalizeFund. Impact Anyone can lock out the manager by calling finalizeFund which sets the manager to 0. This griefing attack can prevent managers from setting correct fees, vault...

A malicious receiver can cause another receiver to lose out on distributed fees by returning false for tokensReceived when receiveRewards is called on their receiver contract.

Handle janbro Vulnerability details Summary A malicious receiver can cause another receiver to lose out on distributed fees by returning false for tokensReceived when receiveRewards is called on their receiver contract. Risk Rating Medium Vulnerability Details A malicious receiver can cause anoth...

function receiveNFTs does not check if amount > 0

Handle paulius.eth Vulnerability details Impact When is1155 is true, function receiveNFTs iterates over all the tokens and updates holdings and quantity1155. If the quantity1155 is 0 for that token, it adds this token to the holdings set. However, it does not check that the amount is greater than...

CVE-2021-32030

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.438446630 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator interface. This relates to handlereques...

ERC-721 Enumerable Spec mismatch for index of tokenByIndex() function

Handle 0xRajeev Vulnerability details Impact Index starts at 0 for token array but the implementation here requires index to be greater than 0. This will prevent querying of token at index 0. See reference implementation This will impact compatibility with NFT platforms that expect full conformit...

Interest debt is capped after a year

Handle @cmichelio Vulnerability details Vulnerability Details The Utils.getInterestOwed function computes the interestPayment as: uint256 interestPayment = calcShare timeElapsed, year, getInterestPaymentcollateralAsset, debtAsset ; // Share of the payment over 1 year However, calcShare caps...

Wrong slippage protection on Token -> Token trades

Handle @cmichelio Vulnerability details Vulnerability Details The Router.swapWithSynthsWithLimit allows trading token to token and specifying slippage protection. A token to token trade consists of two trades: 1. token to base 2. base to token The slippage protection of the second trade base to...

convert collects funds even when minting is disabled

Handle paulius.eth Vulnerability details Impact function convert only performs the conversion when minting is turned on: ifminting However, the funds are collected before and it does not reimburse the sender: function convertForMemberaddress member, uint amount public returnsuint getFundsVADER,...

You can vote for proposal already completed

Handle s1m0 Vulnerability details Impact The mapPIDfinalised is set on completeProposal but voteProposal doesn't check it. A malicious user with enough capital and/or together with other people could execute a proposal in his favor e.g. a grant infinitely. Proof of Concept 1 newGrantProposal 2...

Anyone can curate pools and steal rewards

Handle @cmichelio Vulnerability details Vulnerability Details The Router.curatePool and replacePool don't have any access restriction. An attacker can get a flash loan of base tokens and replace existing curated pools with their own curated pools. Impact Curated pools determine if a pool receives...

Vault rewards can be gamed

Handle @cmichelio Vulnerability details Vulnerability Details The deposit function increases the member's weight by weight = iUTILSUTILS.calcValueInBaseiSYNTHsynth.TOKEN, amount; which is the swap output amount when trading the deposited underlying synth amount. Notice that anyone can create synt...

A proposal can be cancelled by anyone

Handle s1m0 Vulnerability details Impact A proposal can be cancelled by anyone if only exist another proposal with the same type and hasMinority has 16% votes. Proof of Concept 1 voteProposal assume this vote trigger finalise. finalise set mapPIDfinalisingproposalID = true 2 cancelProposal This...

Code different from comment

Handle s1m0 Vulnerability details Impact The formula doesn't coincide with the comment. Proof of Concept Tools Used Manual analysis. Recommended Mitigation Steps Correct the code or the comment. --- The text was updated successfully, but these errors were encountered: All reactions...

Completed proposals can be voted on and executed again

Handle @cmichelio Vulnerability details Vulnerability Details A proposal that is completed has its state reset, including the votes. Users can just vote on it again and it can be executed again. Impact Completed proposals should most likely not be allowed to be voted on / executed again. This cou...

Code is different from comment

Handle s1m0 Vulnerability details Impact The formula is different from the comment, the impact could be high if the comment was actually rigth. Proof of Concept is different from comment on line 234. Should be units = P part1 + part2 / part3 if the comment is rigth. Tools Used Manual analysis...

Tokens can be stolen through transferTo

Handle @cmichelio Vulnerability details Vulnerability Details I know that it's stated that: VADER, USDV, SYNTHS all employ the transferTo function, which interrogates for tx.origin and skips approvals. The author does not subscribe to the belief that this is dangerous In my opinion, it can be ver...

FetLife: Specific Payload makes a Users Posts unavailable

Good Morning, Like we talked about in the email, I'm reporting an issue that I've found that is possible, by crafting a specific payload, other users that try to access /posts of a user will face the 500 Internal Server Error issue, not only when they access the specific crafted post. With this,...

Incorrect operator used in deploySynth() of Pools.sol

Handle 0xRajeev Vulnerability details Impact The deploySynth function in Pools.sol is expected to perform a check on the token parameter to determine that it is neither VADER or USDV before calling Factory’s deploySynth function. However, the require incorrectly uses ‘||’ operator instead of ‘&&’...