Re-entrancy vulnerabilities

Lines of code Vulnerability details Impact Function claimRewards in ConcurRewardPool should be re-entrancy protected or first nullify the reward before sending it, otherwise, if any token contains a transfer callback hook, users can claim the same rewards multiple times, by re-entering the functi...

USDMPegRecovery does not account for fees

Lines of code Vulnerability details Curve.fi pools charge fees when adding or removing liquidity. The only time fees are not applied are when withdrawals are done using removeliquidity. USDMPegRecovery keeps track of tokens deposited and withdrawn, but does not keep track of fees assessed on thes...

Imbalance and LP gain is forever stuck in USDMPegRecovery

Lines of code Vulnerability details Impact After depositing into Curve, underlying USDM and pool3 of each LP share will change due to 1. Swap fee 2. Pool imbalance However, userLiquidity does not update according to current underlying LP balance. When guardian remove liquidity from Curve, at leas...