ConvexStakingWrapper._calcRewardIntegral() Has An Accounting Error When Updating reward.remaining

Lines of code Vulnerability details Impact The ConvexStakingWrapper.sol implementation makes several modifications to the original design. One of the key changes is the way rewards are distributed to stakers. A new ConcurRewardPool.sol contract is used to store rewards, allowing users to claim...

Owner never calls finalize() = rug pull

Lines of code Vulnerability details Impact In order for users to claim their promised tokenOut tokens, the contract owner must call the finalize function. If the owner never calls the finalize function, no user can call the claim function to get their tokens. The owner can call the sweep function...

Double transfer in the transferAndCall function of ERC677

Handle shw Vulnerability details Impact The implementation of the transferAndCall function in ERC677 is incorrect. It transfers the value amount of tokens twice instead of once. Since the Flan contract inherits ERC667, anyone calling the transferAndCall function on Flan is affected by this...

Lack of access control in the parameterize function of proposal contracts

Handle shw Vulnerability details Impact Most of the proposal contracts have a parameterize function for setting the proposal parameters, and these functions are protected only by the notCurrent modifier. When the proposal is proposed through a lodgeProposal transaction, an attacker can front-run...

Slippage protection

Handle pauliax Vulnerability details Impact Consider adding a configurable slippage parameter here to prevent users suffering from sandwitch bots: minAmountsOut0 = 0; minAmountsOut1 = 0; IVault.ExitPoolRequest ... minAmountsOut and used in both sNOTE and TreasuryManager contracts:...

FarmingPools.sol Some users may not be able to get back their funds for tokens with tax on transfer

Handle WatchPug Vulnerability details Per the doc: Token with tax and rewards should accounted correctly and share with all holder accordingly. In the current implementation of FarmingPools.solstake, it assumes that the received amount is the same as the transfer amount, and recording it to...

Calling generateFLNQuote twice in every block prevents any migration

Handle camden Vulnerability details Impact and PoC In the Uniswap helper, generateFLNQuote is public, so any user can generate the latest quote. If you call this twice in any block, then the two latest flan quotes will have a blockProduced value of the current block's number. These quotes are use...

Cvx3CrvOracle does not check that Chainlink data is fresh.

Handle TomFrenchBlockchain Vulnerability details Impact Usage of stale prices when querying chainlink oracles. Proof of Concept Cvx3CrvOracle queries chainlink oracles for the prices of DAI, USDC and USDT, however it doesn't require that the response is fresh by checking which round the answer wa...

Chainlink oracles might return stale data

Handle hack3r-0m Vulnerability details Location: DAI.latestRoundData returns data from the latest round, but there is no guarantee that the latest round happened frequently, it might be a case where latestRoundData has happened 1 hour or 1 day ago. This can lead to stale data used for calculation...

Malicious Users Can Duplicate Protocol Earned Yield By Transferring wCVX Tokens To Another Account

Handle leastwood Vulnerability details Impact ConvexYieldWrapper.sol is a wrapper contract for staking convex tokens on the user's behalf, allowing them to earn rewards on their deposit. Users will interact with the Ladle.sol contract's batch function which: Approves Ladle to move the tokens...

admin is not set in any function

Handle rfa Vulnerability details Impact all function that need to validate msg.sender == admin cannot be run. BscDexAggregator.sol Proof of Concept BscDexAggregator.sol is the child contract of Adminable.sol. some function in it need to validate that msg.sender is admin. There is no function that...

Chainlink oracle query in _validateOrder does not check that response is fresh

Handle TomFrenchBlockchain Vulnerability details Impact Potential for TreasuryManager to use a stale price to calculate the slippage limit, allowing unacceptable slippage relative to if the price feed was current. Proof of Concept EIP1271Wallet queries Chainlink for the most recent price for...

anyone can change Parameters state

Handle jayjonah8 Vulnerability details Impact In BurnFlashStakeDeposit.sol the parameterize function can be called by anyone setting all the Parameters state in the contract. A user should not be able to do this. This function deals with important governance decisions being execute and should onl...

Anyone can withdraw others

Handle mics Vulnerability details Anyone can withdraw users shares. Although we think that they are sent to the right address, it is still 1 not the desired behavior 2 can be dangerous if the receiver is a smart contract 3 the receiver may not know someone withdraw him XOLE.withdrawReward...

Lack of input checks (withrawal penalties should always be greater than 0)

Handle pedroais Vulnerability details Impact If penalties are set to 0 the protocol would be vulnerable to price manipulations like the one described in the contest documentation. Proof of Concept The protocol uses economic penalties to punish withdraws to protect against economic price...

Attacker can collect all positive rebase from the poll

Handle gzeon Vulnerability details Impact The concept of ElasticSwap is not to change relative price upon positive rebase event. However, this allow an attacker to sandwich a known positive rebase event for profit. Proof of Concept 1. Assuming we have pool with 10000 base and 10000 quote token 2...

[WP-H0] In the case of Single Asset Entry, new liquidity providers will suffer fund loss due to wrong formula of ΔRo

Handle WatchPug Vulnerability details Current Implementation When baseToken rebase up Per the document: and related code: Gamma is the ratio of shares received by the new liquidity provider when addLiquidity ΔRo to the new totalSupply total shares = Ro' = Ro + ΔRo. ΔRo = Ro/1 - γ γ Ro Gamma =...

Big deposits will revert

Handle pedroais Vulnerability details Impact Big deposits will revert Proof of Concept If a deposit is greater than the total deposited the transaction will revert. In this line of code totalTokenBalanceStakers - amount is computed. If amount is bigger than TVL staking will revert. I consider thi...

calculateLiquidityTokenFees returns zero fee

Handle sirhashalot Vulnerability details Impact The MathLib.sol calculateLiquidityTokenFees function returns a non-zero fee quantity only if rootK rootKLast. The rootK and rootKLast values are calculated from the same values, so this will never occur. This will result in the DAO never receiving a...

Owner can set arbitrary premium which allow nonStakers drain funds

Handle wuwe1 Vulnerability details Impact Owner can set arbitrary premium, this will cause protocol lose all the activeBalance, stakers lose all the claimable premium and nonStakers can drain all the usdc. Proof of Concept setProtocolPremium does not check the value of premium. premium can be...

setSherlockCoreAddress can be frontruned.

Handle wuwe1 Vulnerability details Proof of Concept SherDistributionManager.sol and AaveV2Strategy.sol are affected by this. For sdm, attacker can monitor mempool and frontrun the setSherlockCoreAddress . By setting the sherlockCore as a address controlled by attacker. Attacker can call pullRewar...

Add a timelock to ExchangeFactory.sol:setFeeAddress() (function that sets a key variable)

Handle Dravee Vulnerability details Impact To give more trust to users: functions that set key/critical variables should be put behind a timelock. Proof of Concept Here, a malicious owner could set the feeAddress to his own and the fee from liquidity tokens that get minted would get stolen: . As...

Possible Re-entrancy in _sendSherRewardsToOwner

Handle static Vulnerability details Vulnerability details Impact If the SHER token performs a callback, such as in ERC-777 tokens, when performing transfers, the sendSherRewardsToOwner function can be run multiple times to extract more rewards than should be available for a single NFT. Proof of...

fundDepositAndReserveFor function does not exist in protocol

Handle harleythedog Vulnerability details Impact The L2Migrator contract makes use of the function fundDepositAndReserveFor on the ticket broker. In the commit hash for the contest seen from this snippet from the contest page: git clone https://github.com/livepeer/protocol git checkout...

If Vault contains tokens that charge a fee on transfer the internally kept balance will be wrong

Handle Ruhum Vulnerability details Impact Some tokens charge a fee for each transfer. USDT, for example, has the possibility of enabling fees at any time. If the vault is used for that kind of token, the internal balance keeping will be wrong. The vault will think that it owns more tokens than it...

[WP-H32] PoolTemplate.sol Attacker can call Factory#createMarket() and transfer funds from another user's wallet to the pool

Handle WatchPug Vulnerability details function initialize string calldata metaData, uint256 calldata conditions, address calldata references external override require initialized == false && bytesmetaData.length 0 && references0 != address0 && references1 != address0 && references2 != address0 &&...

Unbounded iteration over all pools

Handle Dravee Vulnerability details Impact The transactions could fail if the array get too big and the transaction would consume more gas than the block limit. This will then result in a denial of service for the desired functionality and break core functionality. Proof of Concept Tools Used VS...

Expired insurance status set incorrectly after unlock of funds

Handle ye0lde Vulnerability details Impact Expired insurance status set incorrectly after unlock of funds The insurance status is not set to false and the unlock function can be called over and over driving the lockedAmount to 0. The distorted lockedAmount will then cause liquidity and utilizatio...

Signature replay

Handle 0x1f8b Vulnerability details Impact Signature replay in PoolTemplate. Proof of Concept The redeem method of PoolTemplate verifies the data stored in incident, and the verification logic of this process is performed as following: require MerkleProof.verify merkleProof, targets, keccak256...

No slippage protection on _swapUnderlyingToUst can lead to lost funds

Handle harleythedog Vulnerability details Impact The function swapUnderlyingToUst exists to swap underlying tokens to Ust. The last argument to exchangeunderlying is mindy, which specifies the minimum number of Ust to be returned from the swap. Currently, this value is set to 0, so the function i...

Missing slippage/min-return check in NonUSTStrategy

Handle cmichel Vulnerability details The contracts are missing slippage checks which can lead to being vulnerable to sandwich attacks. A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker frontruns the victim trade by also buying asset Y, lets...

[WP-M4] NonUSTStrategy.sol Lack of slippage control

Handle WatchPug Vulnerability details function swapUnderlyingToUst internal uint256 underlyingBalance = getUnderlyingBalance; if underlyingBalance 0 // slither-disable-next-line unused-return curvePool.exchangeunderlying underlyingI, ustI, underlyingBalance, 0 ; The current implementation of...

Lack of slippage checks during swap

Handle ye0lde Vulnerability details Impact Since the code does not use a minimum return value for swaps it is susceptible to sandwich attacks. More information here: Proof of Concept Here the code Calls Curve to convert the existing underlying balance into UST: / Calls Curve to convert the existi...

Reentrancy vulnerability allows attacker to gain more shares than deserved

Handle harleythedog Vulnerability details Impact In Vault.sol, the deposit function is the external function that allows transferring underlying tokens to mint position NFTs. The deposit function first calls createDeposit which creates the position/determines how many shares to allocate, and then...

Tokens can be burned with no access control

Handle sirhashalot Vulnerability details Impact The Vault.sol contract has two address state variables, the keeper variable and the controller variable, which are both permitted to be the zero address. If both variables are zero simultaneously, any address can burn the available funds available...

No slippage tolerance set in NonUSTStrategy

Handle palina Vulnerability details Impact The exchange performed in NonUSTStrategy.sol via Curve is executed with "0" as the minimum amount received as the result of the operation, which is likely to be exploited by front-running and may lead to the loss of funds. Proof of Concept...

Manipulation of the Y State Results in Interest Rate Manipulation

Handle Rhynorater Vulnerability details Impact Due to lack of constraints on user input in the TimeswapPair.solmint function, an attacker can arbitrarily modify the interest rate while only paying a minimal amount of Asset Token and Collateral Token. Disclosure: This is my first time attempting...

Claimer can reenter contract on deposit withdrawal

Handle kenzo Vulnerability details Upon withdrawal of deposit, the claimer will be called with onDepositBurned. This happens after the claimer shares have been updated, but before the underlying has been sent away from the contract. Therefore the claimer can reenter the contract, at an intermedia...

safeSymbol() can revert causing DoS

Handle sirhashalot Vulnerability details Impact The safeSymbol function, found in the SafeMetadata.sol contract and called in 4 Timeswap Convenience contracts in the symbol functions, can cause a revert. This could make the 4 contracts not compliant with the ERC20 standard for certain asset pairs...

Unbounded loop on array controlled by owner can lead to DoS

Handle robee Vulnerability details A malicious attacker that is also a protocol owner can push unlimitedly to an array, that some function loop over this array. If increasing the array size enough, calling the function that does a loop over the array will always revert since there is a gas limit...

Convenience contract fails to function if asset or collateral is an ERC20 token with fees

Handle Ruhum Vulnerability details Impact There are ERC20 tokens that collect fees with each transfer. If the asset or collateral used in a pair is of that type, the Convenience contract fails to function. It always sends the flat amount specified in the function's parameter. If the token collect...

updateDistribution() can unexpectedly revert

Handle sirhashalot Vulnerability details Impact The updateDistribution can revert unexpectedly, which results in the pointsPerUnit state variable not getting updated. Even more impactful is if the value of distributableXDEFI ever reaches a peak and never returns to this number, it will be...

merge() can cause lock to fail due to tokenId collision

Handle WatchPug Vulnerability details function generateNewTokenIduint256 points internal view returns uint256 tokenId // Points is capped at 128 bits max supply of XDEFI for 10 years locked, total supply of NFTs is capped at 128 bits. return points PoC 1. Alice lock 1 XDEFI for 7 days 3 times got...

Missing burn function in _unlock function

Handle Tomio Vulnerability details Impact In the XDEFIDistribution.sol, a user can lock xdefi token and get an erc721/nft token through safeMint function, however when the user call unlock function this contract will delete the position of this user, but didnt call the burn function in ERC721...

XSS in uri token

Handle 0x1f8b Vulnerability details Impact It could be produced an XSS. Proof of Concept The method tokenURI could be used with an arbitrary IPair, if this pair is composed with a specific symbol, it could be produced an uri with XSS inside the SVG file, it will produce an stored XSS. Reference:...

borrow() function has state updates after a callback to msg.sender

Handle jayjonah8 Vulnerability details Impact In TimeswapPair.sol, the borrow function has a callback to the msg.sender in the middle of the function while there are still updates to state that take place after the callback. The lock modifier guards against reentrancy but not against cross functi...

USDV.sol Mint and Burn Amounts Are Incorrect

Handle leastwood Vulnerability details Impact The USDV.mint function queries the price of Vader from the LiquidityBasedTwap contract. The calculation to determine uAmount in mint is actually performed incorrectly. uAmount = vPrice vAmount / 1e18; will return the USD amount for the provided Vader ...

USDV TWAP averages wrong

Handle cmichel Vulnerability details The vader price in LiquidityBasedTWAP.getUSDVPrice is computed using the pastLiquidityWeights and pastTotalLiquidityWeight return values of the syncUSDVPrice. The syncUSDVPrice function does not initialize all weights and the total liquidity weight does not...

Reentrancy in contracts/BorrowerOperations.sol

Handle heiho1 Vulnerability details Impact There are several potential re-entrant functions in contracts/BorrowerOperations.sol: = Function addColl on line 346 is potentially re-entrant as it is external but has no re-entrancy guard declared. This function invokes adjustTrove which potentially...

Pool Manager can frontrun fees to 100% and use it to steal the value from users

Handle pedroais Vulnerability details Impact Pool Manager can front-run entry fee to 100% and users could lose all their deposits Proof of Concept Considering : The pool manager is the creator of the pool Anyone can create a pool Manager is not a trusted actor Anyone can create a pool and get...