Lucene search
+L
Code423n4Most viewed

10190 matches found

Code423n4
Code423n4
•added 2023/12/21 12:00 a.m.•25 views

Business Logic Vulnerability in dropTopVotedPiece Function

Lines of code Vulnerability details Potential Risk: The dropTopVotedPiece function in the CultureIndex contract allows the dropperAdmin to drop the top-voted piece. While the function checks if the caller is the dropperAdmin, there is a potential business logic vulnerability. The function only...

7.3AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/20 12:00 a.m.•25 views

TRST-M-1 finding from previous audit still exists

Lines of code Vulnerability details Proof of Concept Issue TRST-M-1 from previous audit still exist. In order to calculate collateral amount getCollateralCreditCurrente36 function is used. uint tokenValuee36 = ILendingPoolpoolsi.toAmtCurrentsharesi tokenPricee36; tokenValuee36 is usd value of...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/20 12:00 a.m.•25 views

Unchecked return value of low-level call()/delegatecall()

Lines of code 120, 141, 411, 184, 160, 189, 152, 444, 625, 638https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contract...

7.2AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/12 12:00 a.m.•25 views

The owner is a single point of failure and a centralization risk

Lines of code 56, 109, 127, 172, 219, 250, 115, 131, 154, 116, 131https://github.com/Tapioca-DAO/tapiocaz-audit/blob/bcf61f79464cfdc0484aa272f9f6e28d...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/12 12:00 a.m.•25 views

Calls to get_virtual_price() are vulnerable to read-only reentrancy

Lines of code 117 Vulnerability details getvirtualprice was originally considered to be a manipulation-resistant price - suitable as a price oracle, but it was later found to be vulnerable to a read-only reentrancy attack, where the Curve contract could be put into a partially-modified state, and...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/12 12:00 a.m.•25 views

Calls to get_virtual_price() are vulnerable to read-only reentrancy

Lines of code 117 Vulnerability details getvirtualprice was originally considered to be a manipulation-resistant price - suitable as a price oracle, but it was later found to be vulnerable to a read-only reentrancy attack, where the Curve contract could be put into a partially-modified state, and...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/12 12:00 a.m.•25 views

Array is push()ed but not pop()ed, and is iterated over

Lines of code 96, 485, 485, 485, 485, 485, 485, 485, 485, 485, 485https://github.com/Tapioca-DAO/ta...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/12 12:00 a.m.•25 views

Interface improperly implemented

Lines of code 34, 34, 34, 34, 30, 31, 32, 34, 35, 38https://github.com/Tapioca-DAO/tapioca-yieldbox-strategies-audi...

7.1AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/08 12:00 a.m.•25 views

CurveTricryptAdapter::primitiveOutputAmount & Curve2PoolAdapter::primitiveOutputAmount can swap without slippage tolerance

Lines of code Vulnerability details Impact While there is a “Slippage protection” implementation in the contract if uint256minimumOutputAmount outputAmount revert SLIPPAGELIMITEXCEEDED; There is no validation that minimumOutputAmount is not set to 0. This can result in lost of funds. Although Oce...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/08 12:00 a.m.•25 views

No slippage check while removing liquidity from Curve Pool

Lines of code Vulnerability details Impact The hardcoded value of 0 for the minamount parameter in the removeliquidityonecoin function of the Curve pool can have significant effects on user funds. When users are removing liquidity from the curve pool, the minamount parameter represents the minimu...

7.1AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/08 12:00 a.m.•25 views

Upgraded Q -> 2 from #677 [1702060237936]

Judge has assessed an item in Issue 677 as 2 risk. The relevant finding follows: L-04 Deposited amounts in the EigenLayer strategy should be checked before updating the strategy for the asset Users deposit in this protocol and the protocol deposits these funds to EigenLayer strategy contracts...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/12/08 12:00 a.m.•25 views

owner can brick unwrapping by setting unwrap devisor = 0

Lines of code Vulnerability details Impact The protocol does not handle when Ocean.changeUnwrapFee sets unwrapFeeDivisor = 0 gracefully. When setting unwrapFeeDevisor = 0, the function Ocean.calculateUnwrapFee will revert due to a division by 0. This function is used in the callstacks related to:...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/11/29 12:00 a.m.•25 views

Some tokens may revert when zero value transfers are made

Lines of code 356, 371, 145, 272, 252, 116, 445, 374, 506, 488https://github.com/Tapioca-DAO/tap-token-audit/blob/59749be5bc2286f0bdbf59d7ddc258ddafd49a9f/contracts/options/TapiocaOptionBroker...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/11/29 12:00 a.m.•25 views

Unchecked return value of low-level

Lines of code Vulnerability details Impact description of issue/finding Content includes @Audit stack and code example of the issue Assessed type other --- The text was updated successfully, but these errors were encountered: All reactions...

7.4AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/11/17 12:00 a.m.•25 views

Max withdrawable calculation is incorrect in asD contract

Lines of code Vulnerability details Summary The implementation of the max withdrawable amount is incorrect as it divides the calculation by the wrong denominator, leading to an incorrect result and a potential denial of service due to an overflow. Impact In the Application Specific Dollar protoco...

7.4AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/11/15 12:00 a.m.•25 views

Biased rsETH price calculation in depositAsset results in lesser rsETH minted to user

Lines of code Vulnerability details Impact The LRTDepositPool acts as a simplified vault allowing restakers to transfer their liquid staked tokens and receive rsETH tokens based on the current rsETH exchange rate. rsETH are minted to user by interacting with depositAsset function of LRTDepositPoo...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/11/15 12:00 a.m.•25 views

DepositPool is susceptible to the inflation attack

Lines of code Vulnerability details Summary The DepositPool contract is susceptible to the Inflation Attack, in which the first depositor can be front-runned by an attacker to steal their deposit. Impact The DepositPool pool contract acts mainly as a vault: accounts deposit LST assets and get bac...

6.8AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/11/06 12:00 a.m.•25 views

Chainlink oracle will return the wrong price for asset if underlying aggregator hits minAnswer / max answer

Lines of code Vulnerability details Impact Chainlink oracle will return the wrong price for asset if underlying aggregator hits minAnswer / max answer and the deposit asset can be wrongly valued, leads to overborrowing Proof of Concept Chainlink aggregators have a built in circuit breaker if the...

7.2AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/11/05 12:00 a.m.•25 views

There is no check that price from Chainlink hits min/max answer

Lines of code Vulnerability details Impact Chainlink aggregator has bounds minAnswer and maxAnswer within which the price can be set. In a case like LUNA, Chainlink will return minAnswer instead of real asset value, overvaluing it. Proof of Concept Here is explained that current Aggregators have...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/11/03 12:00 a.m.•25 views

Upgraded Q -> 2 from #320 [1699029580772]

Judge has assessed an item in Issue 320 as 2 risk. The relevant finding follows: 2. The governor setting not reliable The initial setting for the voting period in ODGovernor is 15 block, which can be too tight for the governance. Based on Arbitrum block time, which is about 0.26 seconds, which ca...

7.1AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/11/03 12:00 a.m.•25 views

Upgraded Q -> 2 from #165 [1699030231989]

Judge has assessed an item in Issue 165 as 2 risk. The relevant finding follows: Clear safeCan in transferSAFEOwnership Links to affected code Impact Old approval remains even if user gets SAFE again. Proof of Concept There is no removal safeCan at transferSAFEOwnership . When the user gets SAFE...

7.2AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/26 12:00 a.m.•25 views

Sanction Bypass Through Transferring to another account

Lines of code Vulnerability details Impact Wildcat protocol provides lending with lender backed collateral considered as reserves and the ratio must be upheld by the borrower. WildcatMarketTokens are provided to lenders in return for their base assets, these tokens are ERC20 meaning tokens can be...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/26 12:00 a.m.•25 views

wrong implementation of rayDiv.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps function...

7.2AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/26 12:00 a.m.•25 views

DoS Any Escrow by Frontrunning Creation with a Codehash Change

Lines of code Vulnerability details Impact Any escrow contract can be DoSed by sending a 1 wei transaction to the escrow address that will be created for a user. When an account has no code and has never been interacted with, the codehash will be bytes320. This will result in escrow creation...

7.2AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/26 12:00 a.m.•25 views

DoS Any Market by Frontrunning Creation with a Codehash Change

Lines of code Vulnerability details Impact Any market contract can be DoSed by sending a 1 wei transaction to the market address that will be created for a user. When an account has no code and has never been interacted with, the codehash will be bytes320. This will result in market creation...

7.2AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/25 12:00 a.m.•25 views

[ADRIRO-NEW-H-01] VotiumStrategy withdrawal can still be executed with minimal delay

Lines of code Vulnerability details Summary Within the mitigation changes, the sponsor has introduced a minimum delay of one epoch for VotiumStrategy withdrawals, in order to mitigate different issues related to the exposure to CVX . The fix contains an edge case which could still be used to make...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/25 12:00 a.m.•25 views

Scaling Issue in AccountingEngine.auctionSurplus Causing Token Drains

Lines of code Vulnerability details Impact The impact of this vulnerability is significant as it leads to a scaling problem in surplus auctions conducted by the AccountingEngine. The vulnerability arises from the way the amountToSell in surplusAuctionHouse.startAuction call and rad in...

6.8AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/25 12:00 a.m.•25 views

Introduce minEpoch to prevent withdrawal requests being front-runned

Lines of code Vulnerability details Original Issue M-04: VotiumStrategy withdrawal queue fails to consider available unlocked tokens causing different issues in the withdraw process Issue Details The issue raised above occured whenever there was an unlocked balance which could be used to fulfill...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/25 12:00 a.m.•25 views

ODProxy contract can't grant safeRights (can't change the state of the called contracts) which will disable generating debts functionality

Lines of code Vulnerability details Impact The protocol implements a proxy mechanism to enable only the Vault721 contract from transferring SAFEs, as each SAFE is represented by a NFV non fungible vault. This contract has only one function execute that makes delegatecalls to other contracts, so...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/25 12:00 a.m.•25 views

M-05 Unmitigated

Lines of code Vulnerability details Mitigation of M-05: Mitigation Error, see comments Link to Issue: code-423n4/2023-09-asymmetry-findings45 Comments To mitigate M-05, the sponsor has added a delay of one epoch when the available CVX balance is enough to cover the withdrawal: 81: uint256...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/20 12:00 a.m.•25 views

Executor can effectively bypass _checkSubAccountSecurityConfig by adding a new Module

Lines of code Vulnerability details Impact An Executor is an account authorized to perform module execution on a subAccount through the ExecutorPlugin. Gnosis Safe Modules manage to bypass the entire guard logic Safe 1.5 has that new guard hook, but there's also no hook logic done in Brahma. For...

7.5AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/11 12:00 a.m.•25 views

Front-Running during Proxy Creation

Lines of code Vulnerability details Impact An ill-intentioned party might front run every proxy contracts creation and deploy one first causing the transaction for every user to revert. It is worth noting that for this attack to succeed, the attacker would need to get their transaction mined in t...

7.2AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/11 12:00 a.m.•25 views

Needs a secure modifier

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The ERC20ProxyDelegator constructor appears to be used for delegating voting rights to a delegate by allowing them to call the delegate function of an ERC20Votes contract. To secure this function, you...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/10/04 12:00 a.m.•25 views

Loss of interests due to loss of precision

Lines of code Vulnerability details Impact Users can lose accrued interest due to loss of precision during calculation. It is possible that the interestsvTokenuser.rewardIndex is changed and the interestsvTokenuser.accrued is never increased. Proof of Concept The interestsvTokenuser.rewardIndex a...

7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/09/27 12:00 a.m.•25 views

Missing slippage control while depositing rewards in SafEth and VotiumStrategy

Lines of code Vulnerability details Summary Deposits to SafEth and VotiumStrategy coming from rewards lack slippage control, making them susceptible to sandwich attacks by MEV bots, which can result in a loss of funds for the protocol. Impact Rewards coming from the VotiumStrategy contract are...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/09/11 12:00 a.m.•25 views

The roerouter hard-coded address error causes all fee funds to be sent to the treasury instead of the vault

Lines of code Vulnerability details Impact The roerouter hard-coded address error causes all fee funds to be sent to the treasury instead of the vault. This will reduce the capital utilization rate, because the fee should be added to the LP to earn interest, but now because the vault address cann...

6.7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/09/07 12:00 a.m.•25 views

Wrong tick selected by GeVault.getActiveTickIndex()

Lines of code Vulnerability details During mitigation of M-03, the function getActiveTickIndex has been completely rewritten. The new logic uses the following statement to identify the active ticker that represents the Uniswap V3 liquidity pool actively traded: if baseTokenIsToken0 && amt0 == 0 |...

6.7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/09/07 12:00 a.m.•25 views

Token recipient is an inaccessible address for contracts

Lines of code Vulnerability details Impact The msg.sender address from the SourceBridge.burnAndCallAxelar function is used by the DestinationBridge.mintIfThresholdMet function as the TOKEN recipient. However, the msg.sender address will not be controllable by contracts on L2, so any tokens will b...

6.8AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/08/28 12:00 a.m.•25 views

Validating input parameters with the max value of uint

Lines of code Vulnerability details Impact Validating input values with uint256.max will not revert in any condition as solidity v0.8.0 reverts on overflow and underflow. Detailed description of the impact of this finding. Due to solidity v0.8.0 which reverts on overflow and underflow of integer...

7.3AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/08/28 12:00 a.m.•25 views

Max Price Ratio Manipulation

Lines of code Vulnerability details Impact Vulnerable Part in Code: pyinit.divpyinit.subpxinit ABDKMath64x64.divuuintMAXPRICERATIO, 1 here is A scenario where the range of acceptable price ratios is between 1 and 100 for instance, due to a misconfiguration or oversight, the constant MAXPRICERATIO...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/08/26 12:00 a.m.•25 views

M-22 Unmitigated

Lines of code Vulnerability details Comments The underlying yield vaults used by the V5 vaults usually round down shares received when depositing. As a result, if the Vault deposits to an underlying yield vault that has already issued shares, it is possible that a deposit could be rounded down to...

6.7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/08/10 12:00 a.m.•25 views

SecurityCouncilMemberSyncAction : perform function can be continually DOSed which will prevent the valid update the members of the gnosis safe

Lines of code Vulnerability details Impact The securityCouncil update will be prevented by continuously calling the perform function. Since the function rely on the nonce value, this function can be continuously called and nonce value is updated. This would prevent the valid security council upda...

7.2AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/08/10 12:00 a.m.•25 views

Claim reward can be inaccessible if msg.sender is a smart contract with no fallback/receive function

Lines of code Vulnerability details Impact When calling claim on LendingLedger, the claim reward can be inaccessible if msg.sender is a smart contract with no fallback/receive function. Indeed, msg.sender.callvalue: cantoToSend"" would fail and the claim would revert, not allowing the user to...

6.8AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/08/07 12:00 a.m.•25 views

CONTROLLED LOW-LEVEL CALL

Lines of code Vulnerability details Impact The contract was using call which was accepting address controlled by a user. This can have devastating effects on the contract as a delegate call allows the contract to execute code belonging to other contracts but using it’s own storage. This can very...

7.3AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/08/07 12:00 a.m.•25 views

Hardcoded slippage of 95% may not be ideal if liquidity is low or during market volatility, may result in revert when depositing or withdrawing

Lines of code Vulnerability details Impact Larger Deposits and/or withdraw may not work with a 95% slippage parameter. If there are many swaps going on, the slippage should be less restrictive to allow for deposits/withdraws. Proof of Concept In TokenisableRange.sol, the slippage is hardcoded at...

6.7AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/08/04 12:00 a.m.•25 views

The USDOLeverageModule contract's leverageUp function allows for dangerous call delegation

Lines of code Vulnerability details Impact The USDOLeverageModule contract is a module that is used by the BaseUSDO contract to facilitate functionality for leverage actions. The module functionality is invoked through the invocation of a delegatecall within the BaseUSDO contract's executeModule...

7.1AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/07/31 12:00 a.m.•25 views

missing check for the max/min price in the chainlinkOracle.sol contract

Lines of code Vulnerability details Impact the chainlinkOracle.sol contract specially the getChainlinkPrice function using the aggregator v2 and v3 to get/call the latestRoundData. the function should check for the min and max amount return to prevent some case happen, something like this: if cas...

6.8AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/07/29 12:00 a.m.•25 views

Incorrect Signature Validation in LensHub Contract

Lines of code Vulnerability details Description The LensHub contract contains two functions, "setFollowModuleWithSig" and "setProfileImageURIWithSig," that allow users to set a follow module and profile image URI, respectively, for a profile using EIP712 signatures for verification. However, the...

7.3AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/07/21 12:00 a.m.•25 views

M-02 Unmitigated

Lines of code Vulnerability details Original Issue code-423n4/2023-06-angle-findings31 Details It shows LibGetters.getCollateralRatio might return the incorrect ratio due to the unsafe cast. Mitigation PR: AngleProtocol/angle-transmuter@6f2ffcb During the mitigation, it uses the safeCast library...

6.9AI score
SaveExploits0
Code423n4
Code423n4
•added 2023/07/10 12:00 a.m.•25 views

Memory corruption in getBytes32FromBytes() can likely lead to loss of funds

Lines of code Vulnerability details Description The LibBytes library is used to read and store uint128 types compactly for Well functions. The function getBytes32FromBytes will fetch a specific index as bytes32. / @dev Read the ith 32-byte chunk from data. / function getBytes32FromBytesbytes memo...

6.6AI score
SaveExploits0
Total number of security vulnerabilities5000