LP rewards in liquidity_lockbox can be arbitraged

Lines of code Vulnerability details Impact The liquiditylockbox contract is designed to handle liquidity positions in a specific Orca LP pool. Users can deposit their LP NFTs into the contract, receiving in exchange tokens according to their position size. These tokens are minted with the goal of...

Depositors might not be able to withdraw from StabilityPool if any collateral's price drops significantly

Lines of code Vulnerability details In the TroveManager contract, the closeTrove function contains a check to ensure there is more than one trove, as shown below. TroveManager.solL1278-L1282: function closeTroveaddress borrower, address collateral, Status closedStatus internal assertclosedStatus ...

Lack of check could cause lose of user funds

Lines of code Vulnerability details Impact The increaseamount function is currently missing check for attachments and voted. Any amount provided will get added to existing amount. The increased amount will get stuck during withdraw if attachmentstokenId != 0 or votedtokenId Proof of Concept 1. Us...