Lucene search
+L
Code423n4Most viewed

10190 matches found

Code423n4
Code423n4
added 2023/03/07 12:0 a.m.19 views

Index of removed Trove is not updated

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. In the function removeTroveOwner in the TroveManager contract the Trovesborrowercollateral.arrayIndex is still equal to its previous index even though it has been removed from TroveOwners and therefore...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2023/03/07 12:0 a.m.19 views

Contract not initialized after deployment

Lines of code Vulnerability details Impact In ReaperStrategyGranarySupplyOnly.sol, the initialize function is not called after deployment. Left open to unintended behaviour and/or an attacker calling the initialize function, gaining control of core permissions and functions, as highlighted in the...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2023/03/07 12:0 a.m.19 views

Ethos stil using LUSD (not ERN) will lead to confusion and ambiguity of the protocol resulting uncountable risk for the project

Lines of code Vulnerability details Impact Ethos stil using LUSD not ERN will lead to confusion and ambiguity of the protocol resulting uncountable risk for the project Proof of Concept Ethos is a fork project of Liquity with additional changes, supporting multi collateral tokens. There are some...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2023/03/07 12:0 a.m.19 views

pullCollateralFromBorrowerOperationsOrDefaultPool can fail on if _amount will set to zero

Lines of code Vulnerability details Impact Amount can be zero,as there is not no check in place, while collect modules do attempt to send it in such a case anyway. Some ERC20 tokens do not allow zero value transfers, reverting such attempts. As a result, a combination of a token set as a collect...

7AI score
Exploits0
Code423n4
Code423n4
added 2023/03/06 12:0 a.m.19 views

A Malicious Borrower can drain ActivePool

Lines of code Vulnerability details Impact Any Borrower can take any amount of collateral and the pool gets drained, in this case, the system's TCR will go way down the CCR. putting the whole system at risk of a dangerous recovery mode and may even cause a total crash to the system. Proof of...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2023/03/01 12:0 a.m.19 views

Upgraded Q -> 2 from #752 [1677633810856]

Judge has assessed an item in Issue 752 as 2 risk. The relevant finding follows: Possibility of MultiRewardEscrow.claimReward to be vulnerable to a reentrancy attack There are a bunch of external calls before setting accruedRewardsuserrewardTokensito zero. Malicious actors can add some exploits o...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2023/02/12 12:0 a.m.19 views

Upgraded Q -> 2 from #308 [1676219092947]

Judge has assessed an item in Issue 308 as 2 risk. The relevant finding follows: 03 Upgradeable contract is missing a gap50 storage variable to allow for new storage variables in later versions --- The text was updated successfully, but these errors were encountered: All reactions...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2023/02/12 12:0 a.m.19 views

Upgraded Q -> 2 from #293 [1676241639792]

Judge has assessed an item in Issue 293 as 2 risk. The relevant finding follows: 01 USER CAN POSSIBLY TRANSFER NO token0 OR token1 TO TimeswapV2Option CONTRACT IF CORRESPONDING token0 OR token1 IS A REBASING TOKEN When calling the following TimeswapV2Option.mint function, msg.sender uses the...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2023/02/07 12:0 a.m.19 views

First deposit can break share calculation

Lines of code Vulnerability details Impact Vault share price can be maliciously inflated on the initial deposit, leading to the next depositor losing assets due to precision issues. Proof of Concept 147: shares = convertToSharesassets - feeShares; If feeShares = 0 the first depositor of Vault can...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2023/02/01 12:0 a.m.19 views

TOKEN BALANCE OF A PARTICULAR ADDRESS IS NOT CHECKED AGAINST THE REQUESTED TRANSFER AMOUNT INSIDE TRANSFER AND TRANSFERFROM FUNCTIONS IN ERC20.sol CONTRACT

Lines of code Vulnerability details Impact transfer and transferFrom functions do not check for the available erc20 token balance of the from address and the msg.sender respectively against the requested transfer amount. Hence if the balanceOffrom and balanceOfmsg.sender in the transferFrom and...

7AI score
Exploits0
Code423n4
Code423n4
added 2023/02/01 12:0 a.m.19 views

refundETH has no access control and be called repeatedly or Can be Front runned to steal WETH funds from Contract

Lines of code Vulnerability details Impact The function refundETH has no access control and called be called anyone resulting in a loss of WETH funds if address0 is entered as the recipient for removeLiquidity Proof of Concept Consider the scenario if bob calls removeliquidity which returns WETH...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2023/01/30 12:0 a.m.19 views

Drips.sol: drips can be squeezed from before drips.updateTime which allows to drain ALL funds from the protocol

Lines of code Vulnerability details Impact The Drips.squeezeDrips function allows to receive drips from the currently running cycle from a single lender. Drips are configured via the Drips.setDrips function . A Drip can be configured to start at any time. The protocol caps the start time at the...

6.6AI score
Exploits0
Code423n4
Code423n4
added 2023/01/30 12:0 a.m.19 views

withdrawFee() can be called multiple times by any user when quest has ended making it possible to drain contract and leave users unable to claim rewards

Lines of code Vulnerability details Impact The withdrawFee function in the Erc20Quest contract can be called multiple times. The modifier onlyAdminWithdrawAfterEnd is applied to the function which only makes it possible to call it after the end time of a quest. It should be noted that any user is...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2023/01/27 12:0 a.m.19 views

Incorrect totalSupply() function design

Lines of code Vulnerability details Impact In ERC1155Enumerable.solL36-L37 line, totalsuppyl of ERC1155 is calculated packages/v2-token/src/base/ERC1155Enumerable.sol: 34 35: /// @inheritdoc IERC1155Enumerable 36: function totalSupply public view override returns uint256 37: return...

7AI score
Exploits0
Code423n4
Code423n4
added 2023/01/19 12:0 a.m.19 views

Overflow/Underflow in interest calculation caused by lack of timestamp validation in _getInterest() & _getRemainingInterest() function

Lines of code Vulnerability details Impact An attacker could manipulate the last timestamp of a lien in the stack struct to cause an underflow or overflow in the interest calculation. This could result in an incorrect interest amount being calculated, which could lead to incorrect payments being...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2023/01/17 12:0 a.m.19 views

Insufficient Input Validation Leading to Excessive Token Burn.

Lines of code Vulnerability details Impact This vulnerability allows a malicious user to redeem an amount of cash tokens that is less than the minimum redemption amount or more than the user's actual balance. This bug can be considered as a high severity bug, as it allows an attacker to burn an...

6.6AI score
Exploits0
Code423n4
Code423n4
added 2022/12/21 12:0 a.m.19 views

PaprController.onERC721Received() assigns collateral to operator's vault instead of the nft owner's one

Lines of code Vulnerability details Impact The collateral is assigned to the operator's vault because of a parameter mismatch. This impacts the ability of third parties to integrate the PaprController contract. You're not able to create an intermediary contract that adds collateral to a user's...

6.6AI score
Exploits0
Code423n4
Code423n4
added 2022/12/19 12:0 a.m.19 views

Orders may not be fillable due to missing approvals

Lines of code Vulnerability details Not all IERC20 implementations revert when there's a failure in approve. If one of these tokens returns false, there is no check for whether this has happened during the order listing validation, so it will only be detected when the order is attempted. Impact I...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/12/19 12:0 a.m.19 views

rejectProposal/rejectActive/cancel did not update pendingBalances

Lines of code Vulnerability details Impact In the OptimisticListingSeaport contract, pendingBalances represents the number of Rae tokens sent to the contract by the user when creating the proposal, which can be withdrawn in the withdrawCollateral function. function withdrawCollateraladdress vault...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/12/18 12:0 a.m.19 views

GroupBuy may purchase NFT not in the allowed list

Lines of code Vulnerability details Impact When purchaseProof.length == 0, GroupBuy.purchase compare the tokenId with the merkleRoot. This allow any tokenId that match the merkleRoot to be purchased, even if they are not included in the allow list during setup. if purchaseProof.length == 0 //...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/12/16 12:0 a.m.19 views

integer overflow or underflow

Lines of code Vulnerability details Impact If an integer overflow or underflow occurs in the contract, it could lead to incorrect calculations and potentially unintended consequences, such as the transfer of incorrect amounts of tokens or the allocation of incorrect amounts of rewards. This could...

7AI score
Exploits0
Code423n4
Code423n4
added 2022/12/12 12:0 a.m.19 views

depositAndTrade function is incomplete & does not use returnValue of UniswapV3 router

Lines of code Vulnerability details Impact depositAndTrade function seems to be incomplete - the tokenOutput from swapRouter is currently owned by DepositTradeHelper account and needs to be transferred back to msg.sender who initiated this transaction. Since this contract doesn't seem to be part ...

7.1AI score
Exploits0
Code423n4
Code423n4
added 2022/12/09 12:0 a.m.19 views

[NAZ-H2] Update Initializer Modifier To Prevent Reentrancy During Initialization

Lines of code Vulnerability details Impact Currently the project uses both : "@openzeppelin/contracts": "4.2.0", "@openzeppelin/contracts-upgradeable": "4.2.0". This dependency has a known high severity vulnerability Deserialization of Untrusted Data Proof of Concept Because of the Deserializatio...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/12/09 12:0 a.m.19 views

suppliers funds loss because attacker can transfer his collateralized tokens when health factor is below liquidation threshold by reentrancy attack during executeLiquidateERC20() logic and transferring collateralize

Lines of code Vulnerability details Impact Function executeLiquidateERC20 is for liquidating a position if its Health Factor drops below 1. The caller liquidator covers liquidationAmount amount of debt of the user getting liquidated, and receives a proportional amount of the collateralAsset plus ...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/12/02 12:0 a.m.19 views

Relayed calls in EthereumToArbitrumRelayer can be replayed

Lines of code Vulnerability details Impact A relayed call can be processed multiple times allowing somebody to execute the user's call multiple times. The bridge allows arbitrary calls to contracts. Depending on the nature of the call, this could result in a loss of funds for the user. Proof of...

7.2AI score
Exploits0
Code423n4
Code423n4
added 2022/11/14 12:0 a.m.19 views

Exchange owner can consume all orders at arbitrary price

Lines of code Vulnerability details Impact The choice of policy to use for a transaction is determined by the listingTime. The listingTime can be supplied by the caller of execute/bulkExecute and can be arbitrary as along as it passes validation. And the policy of a given order is used to determi...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2022/11/10 12:0 a.m.19 views

Chainlink USD price feeds can have more than 8 decimals

Lines of code Vulnerability details Impact Collateral value is overestimated by orders of magnitude if asset that has a chainlink oracle USD price feed with more than 8 decimals is added. A borrower can borrow much more than allowed in an EscrowedLine Proof of Concept In Oracle.sol the USD price...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/11/08 12:0 a.m.19 views

[PNM-003] finalize can be called by bidders, allows them to cancelBid

Lines of code Vulnerability details Description The finalize function is used to finalize the auction, locking all bids, and paying the seller. However, any user, including bidders can call finalize, as it is a public function, and there are no user checks. This may allow bidders to input malicio...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/11/08 12:0 a.m.19 views

Solmate's SafeTransferLib won't check if token has code, which can affect transfers in SizeSealed

Lines of code Vulnerability details Impact Not checking for token existence is a know issue for Solmate. This can cause unexpected contract functionality for transfers implemented in SizeSealed. Note that this might not be a problem for baseToken due to the check implemented in L103. However, thi...

7AI score
Exploits0
Code423n4
Code423n4
added 2022/10/30 12:0 a.m.19 views

Admin can rug

Lines of code Vulnerability details Impact Admin can rug all of the contract's funds Proof of Concept The function recoverERC20 is only callable by the owner and its goal is: @notice Recovers ERC2O tokens sent by mistake to the contract. The call fails if minAmountRewardTokentoken != 0 , which is...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/10/25 12:0 a.m.19 views

LayerZeroModule miscalculates gas, risking loss of assets

Lines of code Vulnerability details Description Holograph gets it's cross chain messaging primitives through Layer Zero. To get pricing estimate, it uses the DstConfig price struct exposed in LZ's RelayerV2 The issue is that the important baseGas and gasPerByte configuration parameters, which are...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/10/01 12:0 a.m.19 views

The protocol doesn't support fee-on transfer tokens

Lines of code Vulnerability details Impact There are ERC20 tokens that may make certain customizations to their ERC20 contracts. One type of these tokens is deflationary tokens that charge a certain fee for every transfer functions. So if the implementing contract doesn't takes this fee into...

7AI score
Exploits0
Code423n4
Code423n4
added 2022/09/23 12:0 a.m.19 views

Can overflow linear vest calculation and lock up funds

Lines of code Vulnerability details Impact If a Claim object for a user has a large enough vesting time and/or linear vesting amount, then that object can get into a state such that the calculations in baseVestedAmount overflow. If the baseVestedAmount calculations overflow, then the associated...

7.2AI score
Exploits0
Code423n4
Code423n4
added 2022/09/19 12:0 a.m.19 views

Invalid Use of BODMAS in TokenDistributor.sol and PartyGovernanceNFT.sol

Lines of code Vulnerability details Invalid Use of BODMAS in TokenDistributor.sol and PartyGovernanceNFT.sol In contract TokenDistributor.sol we initializing the value of uint128 fee using a mathematical way but in a wrong manner their brackets are missing which will clear out the instance of usi...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/09/08 12:0 a.m.19 views

Unbounded loop on array can lead to DoS

Lines of code Vulnerability details Description: As this array can grow quite large, the transaction’s gas cost could exceed the block gas limit and make it impossible to call this function at all a push exist but there's no pop in the solution, that means it will continuously only push which wil...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/08/17 12:0 a.m.19 views

Able to remove all collateral after borrow

Lines of code Vulnerability details Assuming to borrow asset tokens from a pair contract a user must first deposit collateral tokens. After they deposit collateral tokens their userCollateralBalance increases and they can then call borrowAsset to receive asset tokens from the contract. The...

6.6AI score
Exploits0
Code423n4
Code423n4
added 2022/08/15 12:0 a.m.19 views

[H1] Some admins functions are unusable because of misuse of variables in upgradeable contracts

Lines of code Vulnerability details Impact ​ Admin functions in NFTCollectionFactor.sol are unusable through a proxy Proof of Concept ​ Upgradeable contracts cannot use neither constructors nor use immutable variables. The reason for that is they work behind a proxy which calls them using...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/08/07 12:0 a.m.19 views

MIMOAutoRebalance#rebalance can be used to drain vault due to reentrancy

Lines of code Vulnerability details Impact Vault is drained instead of rebalanced Proof of Concept The caller of rebalance is allowed to supply arbitrary swapData when calling rebalance. The can be used to swap into a malicious ERC20 token that transfers control to the attacker. This opens the...

7.1AI score
Exploits0
Code423n4
Code423n4
added 2022/08/06 12:0 a.m.19 views

PTP-03: Unsafe logic in repayLender() function

Lines of code Vulnerability details PTP-03: Unsafe logic in repayLender function Impact reduceDebt internal function is called before the actual transfer of tokens, meaning that it doesn't matter if the transaction fails or succeeds for any reason, debt will be reduced, causing a loss for the...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/08/06 12:0 a.m.19 views

No storage gap for Upgradable contract might lead to storage slot collision

Lines of code Vulnerability details Impact For Upgradable contracts, there must be storage gap to “allow developers to freely add new state variables in the future without compromising the storage compatibility with existing deployments” quote OpenZeppelin. Otherwise it may be very difficult to...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2022/08/03 12:0 a.m.19 views

AxelarDepositService: When wrappedToken is not weth, sendNative may cause users to lose ether.

Lines of code Vulnerability details Impact In the sendNative function of the AxelarDepositService contract, the wrappedToken address is treated as weth-like and the wrappedToken's deposit function is called. If the wrappedToken address is TokenType.External token and is not weth-like and the...

7AI score
Exploits0
Code423n4
Code423n4
added 2022/08/02 12:0 a.m.19 views

Attacker can empty vaults

Lines of code Vulnerability details Impact Both MIMOEmptyVault and MIMOLeverage contracts share same signature/definition, an attacker can gain control of EmptyVault contract, issue a flash loan, and empty the vaults. Proof of Concept See the test below. In below test, EmptyVault contract is...

7.1AI score
Exploits0
Code423n4
Code423n4
added 2022/07/19 12:0 a.m.19 views

Contracts calls to main ENS services will fail. Plus, ETHRegistrarController#withdraw() with future upgrades will revert

Lines of code Vulnerability details This is a classic Code4rena issue. The transfer call has a hard coded gas budget whenever this affect another part of the EVM will be very harmful for those usage which will make the system and its users at risk. There is two parts of this issue; when the calle...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/07/19 12:0 a.m.19 views

Use SAFETRANSFERFROM() instead of TRANSFERFROM() for ERC721 TRANSFERS

Lines of code Vulnerability details Impact In NameWrapper.sol the wrapETH2LD and unwrapETH2LD functions call transferFrom on a ERC721 token. This does not ensure that the token is not sent to an address that is not able to properly support it which could result in the loss of the token. This is...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/07/19 12:0 a.m.19 views

Call() should be used instead of transfer() on an address payable

Lines of code Vulnerability details Impact The use of the deprecated transfer function for an address will inevitably make the transaction fail when : 1. The withdrawer smart contract does not implement a payable fallback function. 2. The withdrawer smart contract implements a payable fallback...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/06/24 12:0 a.m.19 views

Twav.sol#_getTwav() will revert when timestamp > 4294967296

Lines of code Vulnerability details function getTwav internal view returnsuint256 twav if twavObservationsTWAVBLOCKNUMBERS - 1.timestamp != 0 uint8 index = twavObservationsIndex + TWAVBLOCKNUMBERS - 1 % TWAVBLOCKNUMBERS; TwavObservation memory twavObservationCurrent = twavObservationsindex;...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2022/06/03 12:0 a.m.19 views

Can overfill orders

Lines of code Vulnerability details Impact There's a bug in the partial order filling that allows an attacker to overfill any order fill more than the total size of the order. This bug happens because the fractions are stored as uint120s in orderStatus but intermediate computations to scale the...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2022/06/03 12:0 a.m.19 views

Integer Overflow in Nonce Possible Via EIP 1271 Compliant Contract

Lines of code Vulnerability details Impact The current NonceManager deployed version does not expect a nonce to go as high to actually trigger an integer overflow and is therefore, unchecked. However, it is completely possible to have the nonce go as high with EIP 1271 contracts that hold the NFT...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2022/06/01 12:0 a.m.19 views

Lack of Access Restriction for Conduit Creation

Lines of code Vulnerability details Impact Anyone can call the createConduit function in the ConduitController contract to create new channels and set the conduit owner. This is dangerous because a hacker can create a new conduit and set himself as the owner of the conduit. The hacker can use the...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/05/15 12:0 a.m.19 views

hard-coded slippage may freeze user funds during market turbulence (resubmit to downgrade severity)

Lines of code Vulnerability details Impact GeneralVault.solL125 GeneralVault set a hardcoded slippage control of 99%. However, the underlying yield tokens price may go down. If Luna/UST things happen again, users' funds may get locked. LidoVault.solL130-L137 Moreover, the withdrawal of the...

6.8AI score
Exploits0
Total number of security vulnerabilities5000