Infinite approval given to DepositTradeHelper contract can be misused by malicious actors

Lines of code Vulnerability details Impact depositAndTrade function in DepositTradeHelper account has infinite approval to spend baseTokens & collateralTokens of user using offChain signatures. However, once swapRouter executes UniV3 swap transaction on line 33, the contract does not give up its...

Consider fees while calculating tvl of univ3

Handle 0x421f Vulnerability details As of now fees owed are not being considered I think here due to this A comes in deposits at time X his deposit genrates fess Now though B comes later, he gets unfair adv from As deposit Just use pool.burn to update fees I think --- The text was updated...

Swap functions in ERC20 Vault will cause fund loss

Handle WatchPug Vulnerability details The current implementation of the two swap functions: swapExactInput and swapExactOutput in ERC20Vault.sol is using a wrong value for parameter recipient. Per the interface, the third parameter of trader.swapExactInput and trader.swapExactOutput is "recipient...