Wrong parameter passed inside _storeRebase() in Yieldy Contract

Lines of code Vulnerability details In Yieldy contract, while calling storeRebase in function rebase, updatedTotalSupply is passed instead of currentTotalSupply. Filing this as medium risk , due to two impacts, in the way this parameter is used in storeRebase function. 1. The rebasePercent is...

Front running Staking can bypass warmUpPeriod

Lines of code Vulnerability details Impact Yieldy implements a warmUpPeriod to prevent new stakers from using freshly minted yieldy tokens in the Staking.sol contract. warmUpPeriod is not initialised in the contract initialisation therefore a user can frontrun when the onlyOwner calls...

Yieldy._totalSupply has different upper bounds.

Lines of code Vulnerability details Impact Yieldy.totalSupply has different upper bounds. Yieldy.mint will revert when totalSupply is exactly same as MAXSUPPLY. Proof of Concept From L91-L98, we can see totalSupply can be same as MAXSUPPLY and I think "totalSupply = MAXSUPPLY" is reasonable also...

Sending batch withdrawal requests can possibly DoS

Lines of code Vulnerability details Impact The function BatchRequests.sendWithdrawalRequests allows calling the sendWithdrawalRequests function on all of the Yieldy contracts at once. However, due to the unbounded for loop, if many Yieldy contracts are added to contracts, this function can...

Yieldy._storeRebase() saves and emits wrong values.

Lines of code Vulnerability details Impact Yieldy.storeRebase saves and emits wrong values. I don't think the asset will be lost directly because of this but the rebase storage will have wrong values and it might affect the system later. Proof of Concept The previousCirculating must be a previous...

It's possible to perform DOS and fund lose in Stacking by transferring tokens directly to contract

Lines of code Vulnerability details Impact Function rebase in contract Staking calls Yieldy.rebaseprofit, and Yieldy.rebaseprofit, would revert if rebasingCredits / updatedTotalSupply was equal to 0. it's possible to transfer some STAKINGTOKEN directly to Stacking contract before or after...