M-06 Unmitigated

Lines of code Vulnerability details Original Issue code-423n4/2023-06-angle-findings13 Details This issue shows users may lose a portion of yield when protocolSafetyFee and vestingPeriod are changed. As mitigation, it recommends accruing interests before those parameters are changed. Mitigation P...

Vault funds can be stolen by a malicious Yield Vault.

Lines of code Vulnerability details Impact When a vault is initialized, it sets Max Token Approval for the Yield Vault which allows the Yield Vault to ALWAYS have access to the funds in the vault. Since vaults can be created by anyone as long as they provide an ERC-4626 compliant yield source, an...

Vault.mintYieldFee FUNCTION CAN BE CALLED BY ANYONE TO MINT Vault Shares TO ANY RECIPIENT ADDRESS

Lines of code Vulnerability details Impact The Vault.mintYieldFee external function is used to mint Vault shares to the yield fee recipient. The function is an external function and can be called by anyone since there is no access control. The function will revert only under following two...

Malicious Yield Vault could deny Pool Together withdrawing assets

Lines of code Vulnerability details Impact Since vaults can be created by anyone as long as they provide an ERC-4626 compliant yield source, an attacker could set up a malicious ERC-4626 contract and set that as the yield source for a newly created Vault. The attacker could then have the maliciou...

Interest is not accrued before parameters are updated in SavingsVest

Lines of code Vulnerability details Impact Stablecoin holders can receive wrongly calculated yield in the SavingsVest contract. Also, wrong vesting profit can be slashed when the protocol is under-collateralized. Proof of Concept The SavingsVest contract lets users deposit their stablecoins and...

Loss of staking yield for stakers when another user stakes in pause/frozen state

Lines of code Vulnerability details Impact Loss of staking yield for stakers when another user stakes in pause/frozen state. Proof of Concept Issue 148 from previous audit is present again. As i can see it was mitigated. But maybe after that new code changes were made, so this issue is present...

Integer Overflow

Lines of code Vulnerability details Impact The owner of the ActivePool contract can set yield distribution parameters that do not add to the expected 10000 BPS. This would cause the rebalance function to send the incorrect number of tokens when using the splits. Proof of Concept Calling...

SUSE CVE-2015-5364

The 1 udprecvmsg and 2 udpv6recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service system hang via incorrect checksums within a UDP packet flood...

Permanent freeze of yield when TokenSender rewards bank is depleted and deposit or withdraw is called.

Lines of code Vulnerability details Description In collateral deposit and withdraw flow, a fee is calculated as a percentage of user's requested amount. It is passed to the DepositHook and WithdrawHook, for example in deposit: uint256 amountAfterFee = amount - fee; if addressdepositHook != addres...

Protocol is not able to account for baseTokens generating yield

Lines of code Vulnerability details Impact The protocol's logic is based on the assumption that, while deposited, the underlying baseTokens will generate yield, which accrues to the Traders holding Collateral Tokens. However, there is no mechanism in Collateral.sol to allow it to account for this...

kernel security, bug fix, and enhancement update

5.14.0-162.6.11.OL9 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Yield Monitor Integrates The DeFiChain Blockchain Into Its Database

By Owais Sultan The Yield Monitor database already includes various cryptocurrency projects, such as Algorand ALGO, Avalanche AVAX, Binance BNB, Ethereum ETH, Fantom FTM, and Polygon MATIC. This is a post from HackRead.com Read the original post: Yield Monitor Integrates The DeFiChain Blockchain...

Admin rug vector in moveWithheldETH()

Lines of code Vulnerability details According to the documentation, currentWithheldETH is meant to: withhold part of the ETH deposit for future use, such as to earn yield in other places to supplement the ETH 2.0 staking yield The issue is that the owner can call moveWithheldETH with an arbitrary...

In Notional case Redeemer's redeem() will not do the position redeeming

Lines of code Vulnerability details Currently no actual redeeeming is done in Notional case as maxRedeem is a balance view function that doesn't close the position. This way one more operation, the redeeming itself, is now committed and in Notional case Redeemer's redeem doesn't perform anything,...

Sandwich attacks are possible as there is no slippage control option in Marketplace and in Lender yield swaps

Lines of code Vulnerability details Swapping function in Marketplace and Lender's yield can be sandwiched as there is no slippage control option. Trades can happen at a manipulated price and end up receiving fewer tokens than current market price dictates. Placing severity to be medium as those a...

Yield can be lost due to not specifying limit when transferring auraBAL to BAL/ETH BPT

Lines of code Vulnerability details Impact In harvest, when swapping auraBAL to BAL/ETH BPT the limit variable which specifies the minimum amount of tokens that are to be received when singleSwap.kind=GIVENIN is set to 0. This means that when the swap is made, the transaction can be frontrun and...

Yield can be lost due to not specifying limit when transferring WETH to Aura

Lines of code Vulnerability details Impact In the harvest function, when the contract swaps WETH to Aura, limit is set to 0 allowing an attacker to front run the transaction and cause substantional loss of yield. swapSingleSwap singleSwap, FundManagement funds, uint256 limit, uint256 deadline...

Withdraw function does not conform to EIP4626

Lines of code Vulnerability details Impact The withdraw of wfCashERC4626 is not 4626 compatible. wfCashERC4626.solL186-L191 According to EIP4626 Burns shares from owner and sends exactly assets of underlying tokens to receiver. The withdraw function of ERC4626 should send the exact same amount of...

Reward Manager of the Convex Base Reward Pool Can DoS processYield()

Lines of code Vulnerability details Impact The ConvexCurveLPVault.sol contract allows users to earn a yield on curve token deposits. Rewards are paid out in native CRV and CVX tokens but the reward manager of the base pool may opt to add extra rewards. Because the reward manager has the ability t...

YieldManager: Uniswap token swaps through fixed path may break yield distribution

Lines of code Vulnerability details Details & Impact All harvested yield tokens are swapped through the Uniswap adapter to USDC. While out of scope, the Uniswap adapter code is relevant here, as I note that the path taken for the swap would be assetFrom - WETH - assetTo unless assetFrom is alread...