Transfer fee is burned on wrong accounts

Handle @cmichelio Vulnerability details Vulnerability Details The Vader.transfer function burns the transfer fee on msg.sender but this address might not be involved in the transfer at all due to transferFrom. Impact Smart contracts that simply relay transfers like aggregators have their Vader...

deploySynth does not prevent token to be VADER or USDV

Handle paulius.eth Vulnerability details Impact function deploySynth checks that token is not VADER or not USDV. The condition should be && not || as OR condition always holds when VADER != USDV: function deploySynthaddress token external requiretoken != VADER || token != USDV;...