ArtGobblers.sol#L396-L402 : The function "gobblerPrice()" does not check whether the mint has started or not

Lines of code Vulnerability details Impact This could revert due to undeflow. Proof of Concept While calculating the gobblerPrice, the function does not check whether the mintStart time is started or not. If it is future time, calling this could revert. This could affect the mintFromGoo function ...

Users can regain gobblers they use to mint Legendary Gobbler with.

Lines of code Vulnerability details Impact Users can mint legendary gobblers without actually burning their gobblers by using the GobblersERC721.approve function to approve themselves before minting their legendary gobbler the burn mechanism, doesn't delete the getApproved approved entry for that...

A mistake made by the Minters can result in minting tokens to a wrong address or a zero address.

Lines of code Vulnerability details Impact Tokens can be minted to a wrong address. Proof of Concept The function mintermint is used by the Minters, to mint tokens to the users that successfully used the functions submitAndDeposit, submit and submitAndGive. However there is no check in mintermint...

syncRewards() after xERC4626's beforeWithdraw() can result in wrong reward amount

Lines of code Vulnerability details Impact The withdrawal amount will be counted as part of the surplus asset balance mistakenly if block.timestamp = rewardsCycleEnd. Proof of Concept function beforeWithdrawuint256 assets, uint256 shares internal override super.beforeWithdrawassets, shares; // ca...

In VTVLVesting._baseVestedAmount(), the funds might be locked inside the contract forever with uint112 overflow.

Lines of code Vulnerability details Impact In VTVLVesting.baseVestedAmount, the funds might be locked inside the contract forever with uint112 overflow. Currently, it doesn't consider uint112 overflow during multiply and it's very likely to happen when the vesting duration is not short like 1 yea...

Limited supply of VariableSupplyERC20Token can be bypassed to mint an infinite amount of tokens

Lines of code Vulnerability details Limited supply of VariableSupplyERC20Token can be bypassed to mint an infinite amount of tokens VariableSupplyERC20Token is defined as A ERC20 token contract that allows minting at will, with limited or unlimited supply. No burning possible In the case of a...

DoS With Block Gas Limit

Lines of code Vulnerability details Impact Modifying an array of unknown size, that increases in size over time in the function createClaimUnchecked can lead to Deniel of Service. Proof of Concept When smart contracts are deployed or functions inside them are called, the execution of these action...

An admin can revoke the claim of a given claimant at any time then withdraw the claim due to said claimant.

Lines of code Vulnerability details Impact I understand the reasoning why admins are given the ability to revoke claims but that power in combination with the fact that an admin can then withdraw said claim that was due to a claimant gives rug vibes. This ability should at least be behind a...

createClaim can be circumvented

Lines of code Vulnerability details Impact VTVLVesting.sol has createClaim function for the admins to create claims. However, a malicious admin vector exists inside. The project gives some powerfull access to the admins for some reason as stated on the contest page. And a good intention is to emi...

Outdated Claims can be created which will potentially inflate the vested amounts

Lines of code Vulnerability details Overview In creating claims, the VTVLVesting contract uses various time related variables including startTimestamp and endTimestamp which determines when the linear vesting starts and ends consecutively. This is visible in the createClaim , createClaimsBatch an...

numTokensReservedForVesting is not compared with contract balance

Lines of code Vulnerability details Impact In VTVLVesting contract, the claims are created without comparing the numTokensReservedForVesting variable to the contract balance. If the sum of all user vesting tokens is below this param then the contract will be insolvent to be withdrawn. Proof of...

Eth can be stucked in contract when NFT was gifted to party (AuctionCrowdfund.sol)

Lines of code Vulnerability details Impact We can call function finalize, which will claim the NFT if we won. After claiming the NFT, function will check if contract is the owner of NFT or not. if lastBid == 0 // The NFT was gifted to us. Everyone who contributed wins. lastBid = totalContribution...

Fee = 0 in case supply is less then 10

Lines of code Vulnerability details In case supply is less then 10 fee will be always = 0, which is almost impossible with ETH but it's not 100% excludible with an ERC20 token in case it's value is very high and precision is low . A check that supply shall more then 10 shall be set. --- The text...

Use safeTransfer to send ERC721 tokens

Lines of code Vulnerability details Impact Winner of the auction can lose his NFT Proof of Concept When you settle and auction you transfer the NFT using transferFrom token.transferFromaddressthis, auction.highestBidder, auction.tokenId; Maybe this is just an intended behaviour and is the...

Bids can be created while paused

Lines of code Vulnerability details createBid allows for bid creation while the Auction is paused. As the latter happens on a system error mint failure, this can allow an attacker to interacts with the malfunctioning system. This at least can lead to misallocation of user's funds, i.e. freezing t...

Deniel of service with block gas limit.

Lines of code Vulnerability details Impact An array of unknown size can lead to Deniel of service with block gas limit. Proof of Concept When smart contracts are deployed or functions inside them are called, the execution of these actions always requires a certain amount of gas, based of how much...

Missing access Control to burnFeiHeld function

Lines of code Vulnerability details Impact burnFeiHeld hasn't any owner modifier , so everybody run it Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. function burnFeiHeld external uint256...

in function redeem() of TribeRedeemer users would receive less funds because of rounding error in division in previewRedeem()

Lines of code Vulnerability details Impact Function previewRedeem in TribeRedeemer has been used to calculate the amounts of tokens the user would receive for what the user transfer as redeemedToken. the user would receive a ratio of token balance of the contract which ratio is equal to amountIn ...

Unbounded Loop

Lines of code Vulnerability details 🎨 Category Denial of Service 💥 Impact If the number of tokensReceived gets too big, the transaction's gas cost could exceed the block gas limit and make it impossible to call previewRedeem at all. 📝 Proof of Concept previewRedeem function iterates over all...

Wrong exchange rates after some time, because It's not possible to change excahngeRates after contract deployments, the rates can be changed after some times in real life but it's not possible to change rates in contract

Lines of code Vulnerability details Impact exchange rates are used to calculate amounts of baseToken users received for their cTokens, exchange rates are set when contracts get deployed but it's not possible to change them after some time, so users would get the wrong exchange rates after some ti...

High Potential Redeem function can not be executed because of revert

Lines of code Vulnerability details Impact Inside TribeRedeemer constructor tokensReceived is initialized, and can't be modified anywhere else. previewRedeem function will check balance of tokensReceived tokens of TribeRedeemer contract, and there is a require statement which guarantees that the...

an attacker can take out flash loan and cause users not to be able to redeem their tokens because of undflow or divsion by zero

Lines of code Vulnerability details Impact An attacker can take out a flash loan and cause the state variable redeemBase=1 causing users who call this function to get dosed and since users can't call this function after the attacker makes the reedem function unuseable which can cause funds to be...

TWAP LP price manipulation

Lines of code Vulnerability details Impact The total value locked sum of the pair is used to price the LP. But the reserves of the underlying can be easily influenced by flashloan, then the TVL can vary dramatically.Just like what happened before here Warp. Although getPriceLP use TWAP to calcula...

Miscalculation for cUSDT and cUSDC

Lines of code Vulnerability details Impact getUnderlyingPrice stated that it would return the underlying price of the assets as a mantissa scaled by 1e18. However, the arithmetic setup on lines 503 and 507 could result in answers not scaled by 1e18. Proof of Concept 1e18 1e18 / 10 decimals is...

USE SAME SYMBOL CAN GET FAKED PRICE OF TOKEN

Lines of code Vulnerability details Impact it compare symbol to identify token，it can be exploit to produce fake price of token. Proof of Concept attacker can create a token which is like cToken and has symbol of cNOTE .When somebody call comptroller’s liquidateCalculateSeizeTokens ，it will give ...

[NAZ-M1] Chainlink's latestRoundData Might Return Stale Results

Lines of code Vulnerability details Impact Across these contracts, you are using Chainlink's latestRoundData API, but there is only a check on updatedAt. This could lead to stale prices according to the Chainlink documentation: Historical Price data Checking Your returned answers The result of...

The users are not able to withdraw the swapped amount

Lines of code Vulnerability details Impact The user will invoke swap from Operator.sol to swap their OHM tokens. But he will transfer their OHM and will never get the AmountOut Proof of Concept On Operator.sol: 1- invoking swap with tokenIn == ohm 2- the ohm.safeTransferFrommsg.sender, addressthi...

User can get loan without dept

Lines of code Vulnerability details Impact User can get loan without permission and dept Proof of Concept TRSRY.withdrawReserves does same validation with TRSRY.getLoan and TRSRY.withdrawReserves does not have permissioned modifier, so anyone can get loan from Treasury without any permission and...

possibility of front-run on swap()

Lines of code Vulnerability details Impact The user swapper could lose all their money Proof of Concept 1- the user invokes swap with tokenIn == ohm 2- on this line MINTR.burnOhmaddressthis, amountIn; this user send their money to the TRSRY.sol 3- keeper invoke beat to update the price 4- here...

Privilege Escalation

Lines of code Vulnerability details Impact An attacker with permissions to the INSTR.store function can obtain the "executor" and "admin" role. This implementation also gives space to human error because when the Kernel's executor changes, the permissions to INSTR.store needs to be changed manual...

Check additional fields returned by latestRoundData to ensure price data is not stale/incorrect

Lines of code Vulnerability details Impact Not checking additional fields returned by Chainlink might cause incorrect prices being processed. Proof of Concept The only values being check from latestRoundData are price and updatedAt. File: src/modules/PRICE.sol 161: , int256 ohmEthPriceInt, ,...

getLastPrice() return wrong price

Lines of code Vulnerability details Impact operate and addObservation both of them use PRICE.getLastPrice but it will return wrong price. So all the updates are just random prices Proof of Concept 1- keeper invoke beat on Heart.sol 2- this operator.operate; to trigger price range update and marke...

Invalid payout is accepted

Lines of code Vulnerability details Impact In callback function, getMarketInfoForPurchase also returns maxPayout as last argument. This is not compared against outputAmount which means if market asks for higher outputAmount then the contract will simply pay Similar instance Also check the...

_getPriceDecimals() can return wrong decimal

Lines of code Vulnerability details Impact The decimal returned from function getPriceDecimals is used in function activate to create bond market. If the decimal is not accurate, the price for bond can be wrong, could result in: too low price: abnormal arbitrage opportunity and fund loss to the...

Upgraded Q -> M from 253 [1661943600779]

Judge has assessed an item in Issue 253 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

malicious attacker can manipulate another delegator vote

Lines of code Vulnerability details Impact The function ERC721Checkpointable.delegate is used to change and delegate to another accounts and it call an internal function delegate which will change the delegator of the msg.sender and it will also call another internal function moveDelegates which...

Unchecked Call return value in _refundGas call can fail and contract will not revert

Lines of code Vulnerability details Because payable.call is a low-level call, it will not cause a revert on failure. bool refundSent, = msg.sender.call value: refundAmount ''; This means the function will go through, as if the gas-refund was processed, when it may have not. This can specifically...

Incorrect Withdraw Pattern

Lines of code Vulnerability details Context: NounsDAOLogicV2.solL783-L792 Description: 1 -When we transfer ether with call, we have to check with require whether the bool value will be successful.This part is missing in the code in the contract Proof Of Concept: 2- Since the bool value is not...

Dynamic quorum votes parameters for a proposal (Proposal A) are changed according to another proposal (Proposal B) that proposes to update dynamic quorum votes parameters when Proposal B is executed after Proposal A is created in the same block

Lines of code Vulnerability details Impact The following writeQuorumParamsCheckpoint function is used to record dynamic quorum votes parameters at a block of interest. function writeQuorumParamsCheckpointDynamicQuorumParams memory params internal uint32 blockNumber = safe32block.number, 'block...

LinearInterestRate mode has the risk of drastic fluctuation of interestRate by flash borrow attack, make borrower pay more interest

Lines of code Vulnerability details Impact In LinearInterestRate mode, the minInterest can be as low as MININT=0, and the maxInterest can be as high as MAXINT=146248508681. In getNewRate function, the newRate is determined by utilization. If utilization=1e5, the interestRate can be MAXINT. There...

Pair still operational during pause

Lines of code Vulnerability details Pair still operational during pause Severity: High Context: FraxlendPairCore.solL660 FraxlendPairCore.solL676 FraxlendPairCore.solL786 FraxlendPairCore.solL828https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fb...

Possible frontrunning attack in Vault.

Lines of code Vulnerability details Impact First depositor will have the control of the vault and drain user funds. Proof of Concept The project uses VaultAccount.sol library for math implementations. To determine the number of shares to mint to a depositor, shares = amount total.shares /...

Even if the _isBorrowerWhitelistActive is not active, contract can get deployed if _maxLTV < LTV_PRECISION

Lines of code Vulnerability details Impact FraxlendPairCore can get deployed even if isBorrowerWhitelistActive is not active. Proof of Concept if maxLTV = LTVPRECISION && !isBorrowerWhitelistActive revert BorrowerWhitelistRequired; The above condition revert when both condition is true. Incase,...

Bad access control in AdminRole.sol can lead to griefing DoS by front-running when trying to withdraw treasury funds

Lines of code Vulnerability details Proof of concept FoundationTreasury.sol inherits CollateralManagement.sol which has the method function withdrawFundsaddress payable to, uint256 amount external onlyAdmin that can withdraw the whole balance of the treasury to the to address. It can be called on...

VotingEscrow: Unsupported fee-on-transfer tokens

Lines of code Vulnerability details Impact In the VotingEscrow contract, if the token is a fee-on-transfer token, the number of tokens received by the contract in the createLock and increaseAmount functions will be less than value. This makes the locked balance recorded by the contract incorrect,...

Wrong values are passed to _checkpoint mess up accounting

Lines of code Vulnerability details Impact The increaseUnlockTime function sends a wrong unlock time to the checkpoint function in the oldLocked variable - the locked variable which is the new LockedBalance is copied into the oldLocked variable which is supposed to be the previous LockedBalance,...

The current implementation of the VotingEscrow contract doesn't support fee on transfer tokens

Lines of code Vulnerability details Impact Some ERC20 tokens implemented so a fee is taken when transferring them, for example STA and PAXG. The current implementation of the VotingEscrow contract will mess up the accounting of the locked amounts if token will be a token like that, what will lead...

the 1st creator can get a little amount or 0 creatorShares

Lines of code Vulnerability details Impact On line 513 the MarkerFees.getFees function if there is more than one creatorRecipients it will loop through them and set there payment after that it will subtract creatorRev - totalRoyaltiesDistributed and set it to the the 1st creatorRecipients...

Creator can be incorrectly paid because of array truncate when distributing mint fee.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The creatorRecipient and creatorShares can be forcefully trancated to a fixed length. And the truncated creator is not paid. Proof of Concept Provide direct links to all referenced code in GitHub. Add...

Incorrect implementation of access control in MIMOProxy:execute

Lines of code Vulnerability details Description There is a function execute in MIMOProxy smart contract. The function performs a delegate call to the user-specified address with the specified data. As an access control, the function checks that either it was called by the owner or the owner has...