TEST EDITING

Lines of code L1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assess...

Wrong Type for Time Related Variable

Lines of code Vulnerability details Impact uint8, uint16 was used as Type to declare Time Related Variable in the LiquidationPair.sol contract, this totally wrong as except otherwise stated, seconds is the standard time frame in solidity and the number of digits needed will be too large for uint8...

Lack of authentication in rngComplete

Lines of code Vulnerability details Impact In RngRelayAuction.sol the rngComplete function is meant to be called only by the rngAuctionRelayer contract, however, it can currently be called by any user. Consequently any random number can be used to close a prize pool draw, benefiting the malicious...

_computeRewardFraction logic looks susceptible to manipulation around the edges.

Lines of code Vulnerability details Impact if auctionElapsedTime is 0, it returns the full reward fraction Proof of Concept The RewardLib.fractionalReward calculates the reward fraction linearly based on the elapsed time. When auctionElapsedTime is 0, fractionalReward will return 1 full rewards...

Avoid the use of hard coded slippage

Lines of code Vulnerability details Impact In OptionsPositionManager.sol, swapExactTokensForTokens has used the hardcoded slippage of 1% which is used in withdrawOptionAssets and swapTokens functions. function swapExactTokensForTokensIUniswapV2Router01 ammRouter, IPriceOracle oracle, uint amount,...

the _rngCompletedAt timestamp passed to rngComplete() can be manipulated by the caller to increase their reward

Lines of code Vulnerability details Impact This will result in a larger reward fraction, allowing the caller to unfairly claim more of the rewards. Proof of Concept The rngCompletedAt timestamp is controlled by the caller. They can make auctionElapsedSeconds smaller by providing a higher...

CONTROLLED LOW-LEVEL CALL

Lines of code Vulnerability details Impact The contract was using call which was accepting address controlled by a user. This can have devastating effects on the contract as a delegate call allows the contract to execute code belonging to other contracts but using it’s own storage. This can very...

Wrong Accruing executed in VaultBooster.sol

Lines of code Vulnerability details Impact Accounting error in accruing at VaultBooster.sol will cause unexpected problems in VaultBooster.sol contract. Proof of Concept The accrue function of VaultBooster.sol at : does not check whether the return variable of computeAvailabletokenOut i.e.,...

Overstatement of Available Funds Due to Logic Error

Lines of code Vulnerability details Impact The computeAvailable function in VaultBooster.sol could potentially overstate the available balance in certain situations. Two functions rely on computeAvailable for determining the available funds, such as liquidate, accrue. If the overstated balance fr...

Inflation attacks with virtual shares and assets on GeVault

Lines of code Vulnerability details Impact An inflation attacks can be done on the first deposit into the GeVault contract. Making the first real depositor losing his deposit. Proof of Concept Inflation attack steps : First, Alice the attacker need to craft a deposit that put valueX8 = 1 = Thus...

INCORRECT ACCESS CONTROL

Lines of code https...

INCORRECT ACCESS CONTROL

Lines of code Vulnerability details Impact Access control plays an important role in segregation of privileges in smart contracts and other applications. If this is misconfigured or not properly validated on sensitive functions, it may lead to loss of funds, tokens and in some cases compromise of...

deadline using swap functions does not verify that the deadline has passed/expired

Lines of code Vulnerability details Impact In V3Proxy.sol contract, deadline is used in functions like swapExactTokensForTokens, swapTokensForExactTokens, swapExactETHForTokens, swapETHForExactTokens, swapTokensForExactETH and swapExactTokensForETH etc to ensure that the transaction can be execut...

RngRelayAuction can be bricked or used to specify arbitrary winning random numbers

Lines of code Vulnerability details Impact The RngRelayAuction contract deployed on each chain has a rngComplete method that is supposed to be called by the relayer in order to close/complete a prize draw. However this method doesn't have any access control and can therefore be called by anyone...

rounding error can lead to DISABLE the system

Lines of code Vulnerability details Impact In RNGAuction.sol, openSequenceId if the difference between currentTime and sequenceOffset is less than the sequencePeriod, it will round to zero leading to all functions depending on its value to return false like canStartNextSequence, or even revert in...

Wrong Implementation of Continuous Gradual Dutch Auction

Lines of code Vulnerability details Impact Breaks the core functionality of the Liquidation Pair contract. Usage of wrong formula for calculation of Continuous Gradual Dutch Auction results in wrong calculation of purchase price which is basically used to find the swapAmountIn during liquidations...

Unchecked Call Return Value

Lines of code Vulnerability details Impact The functions do not check the return value of low-level calls. This can lock Ether in the contract if the call fails or may compromise the contract if the ownership is being changed. The following calls were detected without return value validations -...

Potential Near-Zero Scenarios for purchasePrice in the Continuous Gradual Dutch Auction

Lines of code Vulnerability details Impact The Continuous Gradual Dutch Auction CGDA model has potential scenarios where the purchasePrice for an amount of tokens could approach near-zero values. This is influenced mainly by two factors: emissionRate and timeSinceLastAuctionStart. If either one o...

RngRelayAuction.rngComplete() DOS attack

Lines of code Vulnerability details Impact If the recipient maliciously enters the blacklist of priceToken, it may cause rngComplete to fail to execute successfully Proof of Concept The current implementation of RngRelayAuction.rngComplete immediately transfers the prizeToken to the recipient...

Risk of silent overflow in rngComplete rewards cast

Lines of code Vulnerability details Impact The rngComplete function uses the rewards function from the RewardLib library to calculates the rewards that should be given, the rewards returned by the rewards function are of type uint256 but before proceeding to the reward transfer the call to...