Upgraded Q -> H from 215 [1656255310294]

Judge has assessed an item in Issue 215 as High risk. The relevant finding follows: L-09 wfCashERC4626 contract does not conform to EIP4626 Description The wfCashERC4626 contract implements the EIP4626 standard EIP-4626: Tokenized Vault Standard. However, according to EIP4626, the below-mentioned...

Upgraded Q -> H from 222 [1656255302682]

Judge has assessed an item in Issue 222 as High risk. The relevant finding follows: L-02 totalAssets of erc4626 should never revert eip-4626 According to the spec, totalAssets of erc4626 should never revert MUST NOT revert. wfcash would revert if it's matured but hasn't settled...

wfCashERC4626 maxWithdraw, previewWithdraw, previewRedeem, convertToAssets, convertToShares doesn't conform to EIP4626

Lines of code Vulnerability details EIP4626 states that maxWithdraw, convertToAssets, convertToShares, previewRedeem and previewWithdraw must not revert unless due to large input, or due to a reason that will make deposit/redeem revert. However, wfCash4626's implementation of those ends up callin...

Re-entrancy in wfCashERC4626.withdraw() can lead to more gains in assets

Lines of code Vulnerability details This is a corrected version of the previous submission and typo mistakes corrected. Impact The withdraw function in wfCashERC4626.sol can be re-entered at the point of redeemInternal. Assume asset tokens are sent to receiver after shares are burnt, and user...

Loss of underlying tokens due to ERC4626 non-compliance in withdraw function in wfCashERC4626.sol

Lines of code Vulnerability details Impact The withdraw function in wfCashERC4626 is missing the code that transfers the underlying tokens to the receiver. According to the EIP-4626 standard, withdraw function Burns shares from owner and sends exactly assets of underlying tokens to receiver...