updateDistribution() can unexpectedly revert

Handle sirhashalot Vulnerability details Impact The updateDistribution can revert unexpectedly, which results in the pointsPerUnit state variable not getting updated. Even more impactful is if the value of distributableXDEFI ever reaches a peak and never returns to this number, it will be...

merge can fail due to tokenId collisions

Handle cmichel Vulnerability details The XDEFIDistribution.merge function burns tokens, which decreases the ERC721Enumerable.totalSupply and the generateNewTokenId function returns a token ID as the concatenation of the points and totalSupply + 1: function generateNewTokenIduint256 points interna...

Rewards can be stolen by re-entering into updateDistribution

Handle cmichel Vulnerability details The XDEFIDistribution.updateDistribution function does not have re-entrancy locks and can be called from lock - lock - safeMint which gives control back to the msg.sender if it is a contract by performing msg.sender.onERC721Received.... As the...

Its possible to have different bonusMultiplier for same lock duration

Handle hubble Vulnerability details Impact The owner has previledge to change the bonusMultipler for a duration anytime, using the setLockPeriods function. So, its possible to have different bonusMultiplier for different users for same lock duration, which may not be desirable from the protocol...

Reentrancy allows attacker to lock the funds deposited in the contract

Handle tqts Vulnerability details Impact It is possible for attackers to exploit a reentrancy issue in lockuint256,uint256,address that would allow them to lock all funds deposited prior to the attack. Proof of Concept The problem lies in the lockuint256,uint256,address function, that transfers t...

Missing burn function in _unlock function

Handle Tomio Vulnerability details Impact In the XDEFIDistribution.sol, a user can lock xdefi token and get an erc721/nft token through safeMint function, however when the user call unlock function this contract will delete the position of this user, but didnt call the burn function in ERC721...

no check that proposed owner is not the contract itself

Handle jayjonah8 Vulnerability details Impact In XDEFIDistribution.sol the proposeOwnership function sets a pending owner but does not check to make sure that the newOwner is not the contract itself. This check is important to not risk setting the owner to an address that cannot be changed...

No guard against zero address can possibly break functions with onlyOwner modifier

Handle jayjonah8 Vulnerability details Impact In XDEFIDistribution.sol the proposeOwnership function should check that the newOwner arg is not a zero address because one error can break every function in the contract that uses the onlyOwner modifier because if the owner is set to the zero address...

Incorrect fund distribution - updateDistribution not called in lock/unlock

Handle csanuragjain Vulnerability details Impact User will get lesser withdraw amount than they are entitle to. This happens since updateDistribution is not called in locking and unlocking function. Due to this pointsPerUnit does not get updated and hence incorrect withdraw amount gets calculated...