rescueEth does not transfer ether in contract

Lines of code Vulnerability details Impact The InfinityStakerrescueETH and InfinityExchangerescueETH payable functions sends msg.value to the destination and not the ether in the contract, so the fees and accidentally transferred ether is not sent to the destination address Proof of Concept...

Incorrect calculation of startGasPerOrder will cause fund loss to the buyer of the last order due to mischarged gas cost

Lines of code Vulnerability details uint256 gasCost = startGasPerOrder - gasleft + wethTransferGasUnits tx.gasprice; When the orders are matched by the MATCHEXECUTOR, the gas cost of each order is paid by the buyer in WETH, the amount gasCost is calculated based on startGasPerOrder, gasleft and...

Consistently check account balance before and after transfers for Fee-On-Transfer discrepancies

Lines of code Vulnerability details As arbitrary ERC20 tokens can be passed, the amount here should be calculated every time to take into consideration a possible fee-on-transfer or deflation. Also, it's a good practice for the future of the solution. Affected code:...

matchOneToManyOrders doesn't consider numItems of the orders

Lines of code Vulnerability details Impact An order can specify a numItems in MakerOrder.constraints0. This number is the min/max number of items the order wants to buy/sell. For example a buy order can provide a list of nfts and say that wants to buy only 3 of them from that list. The function...

function removeRouter() in RouterFacet don't check that router has balance and don't transfer it, it just set router owner and recipient to 0x0 which can cause make router balance in danger or unavailable for router owner

Lines of code Vulnerability details Impact There are some security levels for router, like setting owner and recipient and when removeRouter is called this values set to 0x0 and router address become vulnerable. contract should transfer router balance to recipient before removing it. Proof of...

_handleExecuteTransaction may not working correctly on fee-on-transfer tokens. Moreover, if it is failed, fund may be locked forever.

Lines of code Vulnerability details Impact handleExecuteTransaction may not working correctly on fee-on-transfer tokens. As duplicated fee is applied to fee on transfer token when executing a arbitrary call message passing request. Moreover, the Executor contract increase allowance on that token...

Maker buy order with no specified NFT tokenIds may get fulfilled in matchOneToManyOrders without receiving any NFT

Lines of code Vulnerability details The call stack: matchOneToManyOrders - matchOneMakerSellToManyMakerBuys - execMatchOneMakerSellToManyMakerBuys - execMatchOneToManyOrders - transferMultipleNFTs Based on the context, a maker buy order can set OrderItem.tokens as an empty array to indicate that...

Did Not Approve To Zero First Causing Certain Token Transfer To Fail

Lines of code Vulnerability details Proof-of-Concept Some tokens like USDT do not work when changing the allowance from an existing non-zero allowance value. For example Tether USDT's approve function will revert if the current approval is not zero, to protect against front-running changes of...

rescueETH function doesn't works as expected

Lines of code Vulnerability details Impact The rescueETH function is implemented to collect any unexpected ETH transferred to the infinityExchange.sol contract, But this function will not work as expected. The function is supposed to return the eth from the contract to the specified destination...

_transferNFTs can end up transferring nothing

Lines of code Vulnerability details Malicious maker can list an NFT that conforms to ERC-165, but reports that it's neither ERC721, nor ERC1155, i.e. both supportsInterface0x80ac58cd and supportsInterface0xd9b67a26 are false. In all other regards it can be fully valid NFT, for example having...

Malicious Relayer Can Replay Execute Calldata On Different Chains Causing Double-Spend Issue

Lines of code Vulnerability details Proof-of-Concept This issue is only applicable for fast-transfer. Slow transfer would not have this issue because of the built-in fraud-proof mechanism in Nomad. First, the attacker will attempt to use Connext to send 1000 USDC from Ethereum domain to Optimism...

Current implementation of arbitrary call execute failure handler may break some use case for example NFT bridge.

Lines of code Vulnerability details Impact Current implementation of arbitrary call execute failure handler may break some use case for example NFT Bridge. In the case of NFT Bridge, NFT may be lost forever. This is likely to be happened in the case of out of gas. Proof of Concept Relayer receive...

Should also check balanceOfRewards in _withdrawAll()

Lines of code Vulnerability details Impact withdrawAll should check that all of your positions are unwinded. It does check balanceOfPool and LOCKER.balanceOf. Then withdrawToVault in BaseStrategy.sol can transfer all want to the vault. But it doesn’t check reward tokens. want could also be one of...

_processExtraToken() in _sendBadgerToTree() will transfer BADGER again

Lines of code Vulnerability details Impact sendBadgerToTree sends amount BADGER to BADGERTREE. However processExtraToken in sendBadgerToTree also sends amount BADGER to the vault. it sends amount BADGER twice. It could result in revert if it doesn't have enough balance of BADGER. Proof of Concept...

Upgraded Q -> M from 44 [1655579898351]

Judge has assessed an item in Issue 44 as Medium risk. The relevant finding follows: 1. Usage of legacy ETH transfer function Risk Low Impact Contract ForgottenRunesWarriors for withdrawing ETH to vault uses send function, which has a fixed gas stipend and can fail. The reason behind this is that...

Upgraded Q -> M from 135 [1655579793739]

Judge has assessed an item in Issue 135 as Medium risk. The relevant finding follows: L send is not recommended for sending native token Since the introduction of transfer, it has typically been recommended by the security community because it helps guard against reentrancy attacks. This guidance...

Upgraded Q -> M from 153 [1655579808802]

Judge has assessed an item in Issue 153 as Medium risk. The relevant finding follows: L03 Callvalue:amt"" should be used instead of send In ForgottenRunesWarriorsGuild.withdrawAll. transfer and send should be avoided because they take a hard dependency on gas costs by forwarding a fixed amount of...

Any User May Transfer Rewards From AuraLocker To MyStrategy These Rewards Are Unaccounted For and Stuck

Lines of code Vulnerability details Impact Harvesting the rewards from AuraLocker incorrectly assumes that rewards are only transferred during harvest when LOCKER.getRewardsaddressthis is called. However it is possible for anyone to call AuraLocker.getRewardsaddressMyStrategy and transfer the...

Upgraded Q -> M from 205 [1655579891083]

Judge has assessed an item in Issue 205 as Medium risk. The relevant finding follows: transfer and send methods are used inside the codebase. Since these methods use 2300 gas stipend which is not adjustable,it may likely to get broken when calling a contract's fallback function if any contract...

Upgraded Q -> M from 117 [1655579798819]

Judge has assessed an item in Issue 117 as Medium risk. The relevant finding follows: Don't use send / transfer to send ETH This is low severity but you should avoid these and use call --- The text was updated successfully, but these errors were encountered: All reactions...