Attacker can steal vault funds through the deposit function.

Lines of code Vulnerability details Impact In the deposit function, a check is made to see if the amount of assets being deposited by the user is greater than the amount of assets the vault currently holds. The vault then transfers the difference between the assets being deposited and the vault’s...

Token holders can create as many proposals as they want if they already have an active proposal by transferring their token to another wallet.

Lines of code Vulnerability details The propose function on NounsDAOV3Proposals.sol has a check called checkNoActivePropds, msg.sender, which exists to prevent token holders from spamming the propose function. Furthermore, the proposeOnTimelockV1 function calls propose directly, making it...

the swapFrom() function allows the Fee On Transfer tokens and _setReserves doesn't revert

Lines of code Vulnerability details Impact the protocol supports the fee on transfer tokens and has implemented a special capable function for it and wants to not allow and revert the fee on transfer tokens in normal SwapFrom function as it says in comments of swapfrom function @dev MUST revert i...

Flash loan price manipulation in Well.sol

Lines of code Vulnerability details Impact Line 214 of Well.sol calculates the price of tokens to tokens in the pool based on the balances at a single point in time. Pool balances at a single point in time can be manipulated with flash loans, which can skew the numbers to the extreme. The single...

Incorrect modification authorization amount

Lines of code Vulnerability details Impact In a specific scenario, the authorized transfer amount from N-M M0, N0 will cause the user to lose M+N money. This solution is to first change the authorized amount to N-0 and then to 0-M. This is not the best solution suggested by the article, and it is...

Functions don't update after being called

Lines of code Vulnerability details Impact Without updating the reserve or vault value of tokens after calling different functions, the contract may be prone to inconsistent state, security issues, financial implications, and bad user experience. It is important to review and update the reserve...

In VirtualAccount.sol.withdrawERC20(), Transaction revert if the Token does not support 0 value transfer

Lines of code Vulnerability details Impact In VirtualAccount.sol.withdrawERC20, Transaction revert if the Token does not support 0 value transfer when transferring tokens to recipient address. File: src/ulysses-omnichain/VirtualAccount.sol 31 function withdrawERC20address token, uint256 amount...

Contracts are vulnerable to rebasing accounting-related issues

Lines of code Vulnerability details Impact Rebasing tokens are tokens that have each holder's balanceof increase over time. Aave aTokens are an example of such tokens. If rebasing tokens are used, rewards accrue to the contract holding the tokens, and cannot be withdrawn by the original depositor...

flashloan stealing staking reward

Lines of code Vulnerability details Impact The report reveals a vulnerability where a flashloan can be used to steal staking rewards. The provided proof of concept demonstrates the issue, where a user can take advantage of the earned rewards calculation using the spot balance. By flashloaning a...

contract has the tendency to mint more tokens than it actually has

Lines of code Vulnerability details Impact If the contract does not have enough esLBR tokens to mint and transfer as rewards, users will not be able to claim their rewards even if they have earned them. Proof of Concept There is no check to ensure that the contract's balance of esLBR tokens is...

distributeRewards can revert because of the too strict slippage check

Lines of code Vulnerability details Impact The report highlights that the distributeRewards function can revert due to a strict slippage check. The provided proof of concept demonstrates the issue, where the slippage is set to 98%, leading to potential transaction failures. Proof of Concept...

An error could lead to coins not being returned to user

Lines of code Vulnerability details Impact The function swapCoins does check that SendCoins does receive them correctly here but not when sending them to the user here Proof of Concept If there is an error returning the swapped coins to the user, they will remain locked. There is no history of...

Loss of airdropped Token or NFT in NFT Bridge

Lines of code Vulnerability details Impact Loss of airdropped Token or NFT in NFT Bridge and Token Bridge Proof of Concept Contract L1ERC721Bridge is for bridging NFTs from L1 to L2 and it holds all the bridged NFTs. Most of the NFT projects would airdrop new NFTs for previous owners or drop ERC2...

There is no check to see if eth was successfully sent from ValidatorWithdrawalVault to StaderStakePoolsManager.

Lines of code Vulnerability details Impact Eth may not complete successfully. As a result, the user will not receive their share from the validator. Tools Used Manual audit Recommended Mitigation Steps Add to StaderStakePoolManager.receiveWithdrawVaultUserShare function. ifmsg.value == 0 revert...

Tokens can be lost when trying to deposit in SDCaollateral.depositSDAsCollateral() or trying to withdraw SDCaollateral.withdraw()

Lines of code Vulnerability details Impact Some tokens do not return the success of the token submission. Because Since we don’t know for sure how the SD token is implemented, we need to take this into account. Proof of Concept A detailed example is listed in: Tools Used Manual audit Recommended...

If no funds are deposited at the beginning, L1-L2 cannot be transferred out

Lines of code Vulnerability details Impact If user transfer tokenA-tokenB from L1 to L2, and the L2 depositstokenBtokenA is zero at the beginning.It will cause user lossing his funds. Proof of Concept First, user transfer TokenA, and it will send Message to L2 and L2 will call finalizeBridgeERC20...

Upgraded Q -> 2 from #11 [1685422294441]

Judge has assessed an item in Issue 11 as 2 risk. The relevant finding follows: L-03:getReward It is recommended to add balance0 before executing transfer getReward will do a transfer on rewaredsToken Since the rewards are from convex, we can't be sure what kind of token it is. we can't be sure...

Return values of weth.transfer() not checked

Lines of code Vulnerability details Impact Return values of weth.transfer not checked Proof of Concept The function weth.transfer has a boolean return value function transferaddress dst, uint wad public returns bool return transferFrommsg.sender, dst, wad; and they indicate errors that way instea...

Minting exposes beneficiaries to unlimited slippage while minting the token out, sending back the token in the terminal.

Lines of code Vulnerability details Impact The amount of tokens minted/assets received when minting can be manipulated to an unlimited extent by manipulating the reserves of the pool. Proof of Concept Here the mint function mints the tokens out to the beneficiary. However the Delegate can't speci...

Inflation attack by token transfer

Lines of code Vulnerability details Impact The first staker can inflate the exchange rate by transferring tokens directly to the contract such that subsequent stakers get minted zero wxETH. Their stake can then be unstaked by the first staker, together with their own first stake and inflation...