Zap contract's redeem() function might transfer more tokens than the user should be able to receive

Handle Ruhum Vulnerability details Impact The redeem function transfers the whole balance of the specified token to the user. That can be more than the amount the user should receive. Because at the time of the call to redeem the Zap contract's balance of the passed token might not be 0. Proof of...

Users Can Frontrun revoke() By Calling vest()

Handle leastwood Vulnerability details Impact The onlyOwner role typically calls revoke if a member leaves the BootFinance team, resulting in vested tokens being transferred to the multisig account. Each vesting account has a revocable state variable that is set to either true or false. As any us...

Use safeTransferFrom instead of transferFrom can improve safety and consistency

Handle WatchPug Vulnerability details vestingToken.transferFrommsg.sender, addressthis, amount; Recommendation Change to: vestingToken.safeTransferFrommsg.sender, addressthis, amount; --- The text was updated successfully, but these errors were encountered: All reactions...

fee-on-transfer underlying can cause problems

Handle 0xsanson Vulnerability details Impact The current implementation doesn't work with fee-on-transfer underlying tokens. Considering that Compound can have these kind of tokens ex. USDT can activate fees, this issue can affect the protocol. The problem arise when transferring tokens, basicall...

ConcentratedLiquidityPoolManager.sol#reclaimIncentive() Unsafe implementation allows malicious users to steal yield

Handle WatchPug Vulnerability details The reclaimIncentive function allows users who added incentives before to withdraw unclaimed rewards. However, the current implementation did not manage the state correctly, incentive.rewardsUnclaimed is not updated after the token transfer, which allows the...

ERC20 return values not checked

Handle cmichel Vulnerability details The ERC20.transfer and ERC20.transferFrom functions return a boolean value indicating success. This parameter needs to be checked for success. Some tokens do not revert if the transfer failed but return false instead. This value is not checked throughout the...

exitZcTokenFillingZcTokenInitiate in Swivel.sol, token transfer may fail without function reverting

Handle GalloDaSballo Vulnerability details Impact exitZcTokenFillingZcTokenInitiate in Swivel.sol uses transferFrom this function can failmeaning tokens are not transferred,without causing a revert. This can break the accounting of the protocol The reason why this can happen is that certain ERC20...

ERC20 return values not checked

Handle cmichel Vulnerability details The ERC20.transfer and ERC20.transferFrom functions return a boolean value indicating success. This parameter needs to be checked for success. Some tokens do not revert if the transfer failed but return false instead. The Manager.recoverToken function does not...

Incorrect accounting on transfer-on-fee/deflationary tokens in Gravity

Handle shw Vulnerability details Impact The sendToCosmos function of Gravity transfers amount of tokenContract from the sender using the function transferFrom. If the transferred token is a transfer-on-fee/deflationary token, the actually received amount could be less than amount. However, since...

reputation risk via upgradable contracts

Handle gpersoon Vulnerability details Impact The contract SwappableYieldSource is upgradable. This means the owner could upgrade and change the contract so any new functionality. Amongst others the owner could retrieve all the tokens of the Yieldsource and transfer them out. The project could sti...

Free stake by replacing input token address

Handle jonah1005 Vulnerability details Impact In PoolOpen contract, pools' authentication is done through baseData. However, it handles token transfer based on the given parameter token. By appending a real token address at the end of the transaction and a fake address in the function parameter,...

No check transferFrom() return value

Handle s1m0 Vulnerability details Impact The smart contract doesn't check the return value of token.transfer and token.transferFrom, some erc20 token might not revert in case of error but return false. In the TracerPerpetualSwaps:deposit and Insurance:deposit this would allow a user to deposit fo...

Code injection

An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer an arbitrary amount of tokens to an arbitrary address...

CVE-2020-17753

An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer an arbitrary amount of tokens to an arbitrary address...

anyone can call function sponsor

Handle pauliax Vulnerability details Impact This function sponsor should only be called by the factory, however, it does not have any auth checks, so that means anyone can call it with an arbitrary sponsorAddress address and transfer tokens from them if the allowance is 0: /// @notice ability to...

Conviction scoring fails to initialize and bootstrap

Handle 0xRajeev Vulnerability details Impact Conviction scores for new addresses/users fail to initialize+bootstrap in ERC20ConvictionScore’s updateConvictionScore because a new user’s numCheckpoints will be zero and never gets initialized. This effectively means that FairSide conviction scoring...

Hypervisor.stake does not transfer tokens

Handle cmichel Vulnerability details Vulnerability Details The Hypervisor's stake action states: token transfer: transfer staking tokens from msg.sender to vault But no tokens are ever transferred. Impact Anyone with a permission can lock any amount of tokens. Recommended Mitigation Steps Transfe...

Unhandled return value of transferFrom in timeLockERC20() could lead to fund loss for recipients

Handle 0xRajeev Vulnerability details Impact ERC20 implementations are not always consistent. Some implementations of transfer and transferFrom could return ‘false’ on failure instead of reverting. It is safer to wrap such calls into require statements or use safe wrapper functions implementing...

timelockERC721Keys could exceed the block size limit

Handle Sherlock Vulnerability details Impact On line 504 of Visor.sol, looping through the timelockERC721Keys could exceed the block size limit Proof of Concept N/A Tools Used Hardhat Recommended Mitigation Steps Transfer by index instead of token ID --- The text was updated successfully, but the...

anyone can call onERC721Received

Handle paulius.eth Vulnerability details Impact function onERC721Received does not authorize a caller thus anyone can add a new NFT passing arbitrary values to nftContract and tokenId even if they do not send the actual NFT. Recommended Mitigation Steps Authorize the caller depending on the...