At LidoVault.sol, _withdrawFromYieldPool()function, ETH transfer return value is not checked

Lines of code Vulnerability details Impact At withdrawFromYieldPool ETH transfer return value is not checked as the return statement at line 141 breaks the return value checking. Proof of Concept function withdrawFromYieldPool address asset, uint256 amount, address to internal override returns...

Users Can Game Yield Distributions

Lines of code Vulnerability details Impact processYield restricts who can call this function to just the vault admin. Upon being processed, the treasury receives its fair share of the yield and the rest is transferred to the YieldManager.sol contract. To distribute yield, the manager calls...

Attacker could make deposits of 1 wei in the yield contract to prevent excess rewards from being withdrawn

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept If an attacker makes many deposits of 1 wei the staking pool creator will have to make the withdraws himself to remove the unclaimed reward tokens. This can mean the pool creator will...

Pool has free access to all funds without using the redeem method

Lines of code Vulnerability details Impact Pool has access to all funds even if they weren't deposited by the pool Proof of Concept The AAVE yield source contract allows anyone to deposit and withdraw funds that are deposited or withdrawn from AAVE. In the constructor of the contract, max approva...

NonCustodialPSM can become insolvent as CPI index rises

Lines of code Vulnerability details Impact NonCustodialPSM mints and redeems VOLT to a chosen stablecoin at the current market rate minus a fixed fee. It is assumed that the difference to be covered with pcvDeposit funds. That assumption is similar to one used in FEI protocol, but there no rate...

[WP-H4] anchor_basset_reward pending yields can be stolen

Lines of code Vulnerability details For yield farming aggregators, if the pending yield on an underlying strategy can be harvested and cause a surge of rewards to all existing investors, especially if the harvest can be triggered permissionlessly. Then the attacker can amplify the attack using a...

Malicious Users Can Transfer Vault Collateral To Other Accounts To Extract Additional Yield From The Protocol

Handle leastwood Vulnerability details Impact ConvexYieldWrapper.sol is a wrapper contract for staking convex tokens on the user's behalf, allowing them to earn rewards on their deposit. Users will interact with the Ladle.sol contract's batch function which: Approves Ladle to move the tokens...

Re-try withdrawAll from inactive strategy

Handle pauliax Vulnerability details Impact When the withdrawAll from yieldStrategy fails, it nevertheless sets the new yieldStrategy and the old one is forgiven. try yieldStrategy.withdrawAll catch bytes memory reason emit YieldStrategyUpdateWithdrawAllErrorreason; emit...

Owner should be able to choose to not ignore failures in updateYieldStrategy

Handle harleythedog Vulnerability details Impact In Sherlock.sol, the function updateYieldStrategy ignores all errors when yieldStrategy.withdrawAll is called, and I believe this is an dangerous design choice. If yieldStrategy.withdrawAll reverts, then all the funds that are deposited in the yiel...

Sherlock: Decouple yield strategy with withdrawals

Handle GreyArt Vulnerability details Impact If there are funds remaining in an old strategy, there is only 1 way to claim those funds which is through Sherlock.updateYieldStrategy . It is quite an inconvenience to do this. Recommended Mitigation Steps Create an additional function to allow anyone...

CVE-2020-23315

There is an ASSERTION pFuncBody-GetYieldRegister == oldYieldRegister failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore version 1.12.0.0-beta...

CVE-2021-24044

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error,...

Vault: onDepositMinted() reentrancy causes users’ deposits to be erroneously accounted as yield

Handle hickuphh3 Vulnerability details Impact The deposit function does not have reentrancy protection. This allows reentrancy to occur through the implementation of a malicious claim’s beneficiary onDepositMinted function that will cause all users’ deposits to be erroneously interpreted as yield...

Claimer can reenter contract on deposit withdrawal

Handle kenzo Vulnerability details Upon withdrawal of deposit, the claimer will be called with onDepositBurned. This happens after the claimer shares have been updated, but before the underlying has been sent away from the contract. Therefore the claimer can reenter the contract, at an intermedia...

When a user performs a withdrawal operation, a rollback that is not considered by the program may be triggered.

Handle ACai Vulnerability details Impact When the Vault contract deposits all/most of the token into the strategy contract, so that the remaining tokens in the Vault contract are less than the user's deposit, the user's withdrawal operation will result in a rollback that is not considered by the...

Depositor can reenter contract on claim creation

Handle kenzo Vulnerability details This finding is almost identical to my previous finding "Claimer can reenter contract on claim creation", but in this scenario, the depositor can reenter via Depositors' safeMint function. When depositing, Depositors is minting the token using safeMint, which wi...

Claimer can reenter contract on claim creation

Handle kenzo Vulnerability details Upon deposit, the claimer will be called with onDepositMinted. This happens after the claimer shares have been updated, but before the underlying has been pulled to the contract. Therefore the claimer can reenter the contract, at an intermediary state where the...

WJLP loses unclaimed rewards when updating user's rewards

Handle kenzo Vulnerability details After updating user's rewards in userUpdate, if the user has not claimed them, and userUpdate is called again eg. on another wrap, the user's unclaimed rewards will lose the previous unclaimed due to wrong calculation. Impact Loss of yield for user. Proof of...

ActivePool does not update rewards before unwrapping wrapped asset

Handle kenzo Vulnerability details When ActivePool sends collateral which is a wrapped asset, it first unwraps the asset, and only after that updates the rewards. This should be done in opposite order. As a comment in WJLP's unwrapFor rightfully mentions - "Prior to this being called, the user...

Users Can Siphon AaveYield Rewards By Depositing And Withdrawing Collateral

Handle leastwood Vulnerability details Impact The AaveYield contract provides users with the option to choose Aave as their strategy of choice to generate yield. Users will make deposits to this strategy via the SavingsAccount contract. Upon deposit, shares are minted at a 1:1 exchange rate and t...