Unsafe message encode and decode for cross chain message transfer and in execution process through axelar

Lines of code Vulnerability details Impact The cross chain message passing is done through the axelar gateway contracts. To pass the message, the message has to be formatted abi.encode and sent to destination chain from source chain. In destination chain, through gateway contract, the received...

Lack of ERC1155 Token Balance Check in flashloan Smart Contract Function

Lines of code Vulnerability details Description: : The flashloan function in the code you provided does not check if the amount of ERC1155 tokens being flashed is available. This could lead to a situation where the function fails to complete because the caller does not have enough ERC1155 tokens ...

GeVault LP calculations do not use scaling and are vulnerable to deposit attacks

Lines of code Vulnerability details Impact Currently, getTVL counts all token balances in GeVault, and attackers can manipulate getTVL to implement deposit attacks. Secondly, since the calculation of LP does not use scaling, because there is a precision error in the division, the cost for the...

M-08 Unmitigated

Lines of code Vulnerability details Comments The success of low-level calls is not checked in V3Proxy. If msg.sender is a contract and the fallback function has additional logic, the protocol will succeed transfer by default, which will result in the loss of user funds. Mitigation There is no...

Wrong calculation of elapsed days

Lines of code Vulnerability details Impact For a certain period of time, the dailyIr is compounded every day. However, when calculating prevClosePrice, the last day's addition is missed. The formula for calculating the current price is as follows: Range.dailyInterestRate Days Elapsed + 1...

lack of address(0) check for oracle address

Lines of code Vulnerability details Impact no oracle no updated prices. Not sure what happens if try to call getPrice in this scenario, but IF it returns price of zero, then number of tokens from getRUSDYByShares will be zero for any amount of USDY shares... Proof of Concept Tools Used Recommende...

Lack of Oracle Price Validation in rUSDY

Lines of code Vulnerability details Summary Ondo's custom oracle, RWADynamicOracle, is responsible for delivering the price of USDY to the rUSDY token contract. The oracle is called in four different functions for the price of USDY; the results of which are also used in core functions in the toke...

PerpetualAtlanticVaultLP incentives can be stolen via flash loan

Lines of code Vulnerability details Impact The liquidity pooled from the PerpetualAtlanticVaultLP is used by the core contract. This liquidity is provided by anyone, and after each epoch 1 week an incentive is paid after to further incentivise liquidity provision. However, the funds can be stolen...

DOS in governance when voting after delegate

Lines of code Vulnerability details Impact The GovernorCountingOverridable::handleVoteOverrides function substracts the delegator vote weight from the total votes when the delegatee has already submited a vote. However, if the delegator's vote is greater than the current total vote the substracti...

Missed approving to UniswapV2Router

Lines of code Vulnerability details Impact The contract should have already granted an allowance of at least minamountOfWeth for the input token. This step is missing during the UniswapV2Router call within the lowerDepeg function. // @audit msg.sender should have already given the router an...

Potential Over-redemption Vulnerability in redeem Function

Lines of code Vulnerability details Impact In the redeem function, when a third party is using their allowance to redeem shares on behalf of an owner, there exists a potential scenario where the third party could redeem more than originally intended by the owner. Proof of Concept This is how the...

RDPX price manipulation benefit for attacker via a Flashloan attack

Lines of code Vulnerability details Impact As the RdpxV2Core contract burns RDPX tokens, a malicious attacker can benefit from a price manipulation attack using a flashloan attack Proof of Concept The function bond in the RdpxV2Core contract is a primary function to enter the protocol and bond...

Accounting for Fixed_Fee and Base_Fee twice leading to less amount or token recieved

Lines of code Vulnerability details Impact There are multiple instances where fees is deducted twice. I will explain this with one function similar logic follows in other functions as well.So whenever the swapGivenInputAmount function is called by the user with inputAmount provided by the user th...

Lack of balance checks in the depositGivenInputAmount function

Lines of code Vulnerability details Impact Lack of balance checks in the depositGivenInputAmount function can lead to various unpredictable consequences due to the breach of requirement "The pool's ratio of y to x must be within the interval MINM, MAXM". Proof of Concept The depositGivenInputAmou...

Swapping lacks deadline check

Lines of code Vulnerability details Impact There is no deadline when swapping tokens using EvolvingProteus. Swaps that are done through low gas transactions may be stuck in the mempool for a long time, resulting in unfavourable swap. Proof of Concept Evolving prometeus seems like an upgrade to...

RESERVE BALANCE BOUNDRY CHECKS IN _checkBalances FUNCTION IS ERRORNEOUS DUE TO WRONG INPUT PARAMETERS PASSED IN

Lines of code Vulnerability details Impact The EvolvingProteus.swap function is used to swap one token Specified token to another non-specified tokenusing the liquidity pool. The protocol charges the fee on the swap transactions by calling the applyFeeByRounding function as shown below:...

Condition will not revert when block.timestamp is == to the compared variable

Lines of code Vulnerability details Medium Issues | | Issue | Instances ---|---|--- M-1 | Condition will not revert when block.timestamp is == to the compared variable | 1 M-1 Condition will not revert when block.timestamp is == to the compared variable The condition does not revert when...

swapGivenInputAmount checks the wrong result out

Lines of code Vulnerability details Impact Wrong check amount results in unusable function. Proof of Concept swapGivenInputAmount calcaultes the value of result after calling swap. The check then requires that result 0. However, the comment states that amount cannot be less than 0...

withdrawGivenInputAmount() calls _lpTokenSpecified with the wrong value of feeDirection

Lines of code Vulnerability details Impact withdrawGivenInputAmount calls lpTokenSpecified with the wrong value of feeDirection: function withdrawGivenInputAmount uint256 xBalance, uint256 yBalance, uint256 totalSupply, uint256 burnedAmount, SpecifiedToken...

Swap Tokens with Fee Consideration and Balance Checks

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. In the swap function, the discrepancy lies in the usage of the variable specifiedAmount instead of roundedSpecifiedAmount when checking the final balance in the swap function. if specifiedToken ==...

Using incorrect parameter for checking the reserve

Lines of code Vulnerability details Impact At line 549 within the swap function's code, the internal call to the function checkBalances checks the reserve for token x is carried out using xi + specifiedAmount instead of xi + roundedSpecifiedAmount. When using roundedSpecifiedAmount passes the che...

H-05 Unmitigated

Lines of code Vulnerability details Issue not mitigated About the problem sponsor function allows caller to delegate his shares to the special address. In this case caller losses ability to win prizes. Previous version of code had sponsor function, which allowed to deposit funds on behalf of owne...

M-02 Unmitigated

Lines of code Vulnerability details Comments In the previous implementation a malicious user could set arbitrary vault hooks for afterClaimPrize and beforeClaimPrize that could be used to gas grief the claimer or cause other claims in the same call to fail by deliberately reverting Mitigation The...

SecurityCouncilMemberSyncAction.perform is not exclusively can be scheduled from SecurityCouncilManager's operations

Lines of code Vulnerability details Impact SecurityCouncilMemberSyncAction.perform is a crucial function that will be triggered by upgrade executor via delegate call after the whole election process or after current members do some update add/remove/replace/rotate to update security council...

Security council election are vulnerable to signature replay attack

Lines of code Vulnerability details Impact SecurityCouncilNomineeElectionGovernor and SecurityCouncilMemberElectionGovernor contracts both inherit castVoteWithReasonAndParamsBySig function from the base GovernorUpgradeable contract, but implement custom countVote function respectively. The...

Stealing or reusing votes

Lines of code Vulnerability details Impact It is possible to reuse/steal user's votes if they are supposed to cast vote by signature. Proof of Concept Casting votes during nominee election and member election is possible by calling the functions: castVoteWithReasonAndParams...

Absence of zero address checks for roles passed to the initialize function.

Lines of code Vulnerability details Impact The initialize function accepts various roles as part of the roles parameter SecurityCouncilManagerRoles. However, it doesn't validate whether any of these role addresses are set to the zero address address0. This omission might result in inadvertently...

TEST EDITING

Lines of code L1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assess...

Anyone can become owner of GnosisSafe(securityCouncil) contracts

Lines of code Vulnerability details Impact Member roles in SecurityCouncilManager contract can change owners of GnosisSafesecurityCouncil contracts by schedulinig a perform call to ArbitrumTimelock contract. However the contract that handles updating ownerssecurity council members with perform...

Vulnerability: Donation Attacks can Cause Loss of Liquidity and/or Undesired Prices Rebalance / Contract: GeVault / Function: withdraw

Lines of code Vulnerability details Impact Donation attack can cause loss of users liquidity or undesired tick rebalance by price manipulation. Proof of Concept An attacker can cause constant rebalancing, instability, and along with the vulnerability of slot0 in the getTokenAmountsExcludingFees...

Too many rewards are distributed when a draw is closed

Lines of code Vulnerability details Impact A relayer completes a prize pool draw by calling rngComplete in RngRelayAuction.sol. This method closes the prize pool draw with the relayed random number and distributes the rewards to the RNG auction recipient and the RNG relay auction recipient. These...

slot0 is easily manipulatable

Lines of code Vulnerability details Impact The deposit amount of a user can be manipulated. Proof of Concept slot0 is extremely easy to manipulate as it is the most recent data point. The issue arises due to there not being any protection against sqrtPriceX96 manipulation. // @audit no check...

Hardcoded slippage of 95% may not be ideal if liquidity is low or during market volatility, may result in revert when depositing or withdrawing

Lines of code Vulnerability details Impact Larger Deposits and/or withdraw may not work with a 95% slippage parameter. If there are many swaps going on, the slippage should be less restrictive to allow for deposits/withdraws. Proof of Concept In TokenisableRange.sol, the slippage is hardcoded at...

REENTRANCY

Lines of code Vulnerability details Impact In a Re-entrancy attack, a malicious contract calls back into the calling contract before the first invocation of the function is finished. This may cause the different invocations of the function to interact in undesirable ways, especially in cases wher...

Assets from the old step are not properly transferred to a new TR position

Lines of code Vulnerability details Impact The transferAssetsIntoStep function's intent is to serve two purposes: transferring aAssets to a target TR position and moving assets from an old step to a target TR position. However, in practice, assets removed from the old step are not integrated into...

UNCHECKED TRANSFER

Lines of code Vulnerability details Impact Some tokens do not revert the transaction when transferFrom fails and returns False. Hence we must check the return value after calling the transfer or transferFrom function. Proof of Concept Check the last answer here: In short: Using...

RemoteOwner circular dependency at deployment time

Lines of code Vulnerability details Impact The RemoteOwner.sol contract has a security measure that ensures the sender from the remote/origin chain was the origin chain owner i.e. a RngAuctionRelayerRemoteOwner.sol deployment, and this address is set at deployment time in the constructor. The...

An attacker could manipulate the _rngAuctionResult to unfairly distribute more rewards to themselves

Lines of code Vulnerability details Impact When the rewards are calculated using computeRewards, the attacker's inflated rewardFraction will be used, giving them a bigger share Proof of Concept The rngAuctionResult passed to rngComplete is stored directly into the auctionResults array without any...

Insufficient input validation can lead to loss of funds

Lines of code Vulnerability details Impact The VaultBooster.sol contract allows someone to liquidate tokens for a vault and improve the vault's chance of winning. The prizePool.prizeToken is set in the constructor and liquidationPair set in the setBoost function. However, the external deposit...

RngRelayAuction can be bricked or used to specify arbitrary winning random numbers

Lines of code Vulnerability details Impact The RngRelayAuction contract deployed on each chain has a rngComplete method that is supposed to be called by the relayer in order to close/complete a prize draw. However this method doesn't have any access control and can therefore be called by anyone...

swapExactAmountOut() no deadline protection

Lines of code Vulnerability details Impact no deadline protection , users may suffer losses Proof of Concept LiquidationRouter.swapExactAmountOut use for swap tokens. However, currently only amountInMax slippage protection is provided, and not deadline protection like the common AMMS protection...

Missing flash loan initiator check allows attacker to open trades, close trades and steal funds

Lines of code Vulnerability details Impact The attacker can close trades, partially close trades and even steal funds. Proof of Concept The OptionsPositionManager.executeOperation function is called when a flash loan is made and it can only be called by the lendingPool. The wrong assumption by th...

call() should be used instead of transfer() on an address payable

Lines of code Vulnerability details Impact The use of the transfer function for sending ETH to an address will inevitably make the transaction fail when: The claimer smart contract does not implement a payable function. The claimer smart contract does implement a payable fallback which uses more...

Some functions in TokenisableRange contracts does not allow user to deadline.

Lines of code Vulnerability details Impact Not allowing users to supply their own deadline could potentially expose them to sandwich attacks Proof of Concept Consider the following scenario: if fee0 100 bal0 && fee1 100 bal1 TOKEN0.token.safeIncreaseAllowanceaddressPOSMGR, fee0;...

Lack of slippage checks on public withdraw fees function

Lines of code Vulnerability details Impact function withdrawAllMarketFees IMarket calldata markets, ISwapper calldata swappers, IPenrose.SwapData calldata swapData public notPaused require markets.length == swappers.length && swappers.length == swapData.length, "Penrose: length mismatch" ;...

Broker Address can be Claim by a MEV Bot

Lines of code Vulnerability details Impact If the broker address is a malicious user, he can mint as many OTAP as he wants. Proof of Concept Protocol deploy the OTAP contract A Bot wait until the contract is deployed Then call the "brokerClaim" straight away with his own address. He can then call...

Malicious user can drain the Singularity contract of it's liquidity

Lines of code Vulnerability details Impact The SGLCollateral contract has functionality to allow users to remove and add collateral for the Singularity market. The addCollateral function accepts a skim parameter that, if defined as true, will cause the internal addTokens function to assert that t...

Potential Loss of Rewards During Token Transfers in StaticATokenLM.sol

Lines of code Vulnerability details Impact This issue could lead to a permanent loss of rewards for the transferer of the token. During the token transfer process, the beforeTokenTransfer function updates rewards for both the sender and the receiver. However, due to the specific call order and th...

Integer overflow in getDerivedPrice()

Lines of code Vulnerability details Impact An integer overflow could cause the getDerivedPrice function to return an incorrect price. This could lead to financial losses for users of the contract. Proof of Concept Sure, I can generate a report with this information for all the bugs in the smart...

First Depositor Attack is possible by front-running mip00 script execution

Lines of code Vulnerability details Overview The First Depositor Attack Within the context of Compound v2, a First Depositor Attack occurs when an attacker becomes the inaugural minter of a cToken. This enables them to establish the first exchange rate between the underlying asset and the cToken...