depositAndFix can be made to fail

Handle cmichel Vulnerability details There's a griefing attack where an attacker can make any user transaction for TempusController.depositAndFix fail. In depositAndFix, swapAmount many yield shares are swapped to principal where swapAmount is derived from the function arguments. A final...

exitTempusAMM can be made to fail

Handle cmichel Vulnerability details There's a griefing attack where an attacker can make any user transaction for TempusController.exitTempusAMM fail. In exitTempusAMM, the user exits their LP position and claims back yield and principal shares. The LP amounts to redeem are determined by the...

exitTempusAMMAndRedeem redeems to the wrong account

Handle cmichel Vulnerability details In TempusController.exitTempusAMMAndRedeem the first one, the inner exitTempusAMMGivenAmountsOut call redeems LP tokens and sends the yield&principal shares to the msg.sender already. It then tries to redeem the received shares for backing tokens or...

Steal tokens from TempusController

Handle gpersoon Vulnerability details Impact The function depositAndProvideLiquidity can be used go retrieve arbitrary ERC20 tokens from the TempusController.sol contract. As the test contract of TempusController.sol shows, it has indeed ERC20 tokens. The problem is due to the fact that you suppl...