Locked funds are debited twice from user during tokenization leading to fund loss

Handle 0xRajeev Vulnerability details Impact During tokenization of conviction scores, the user can optionally provide FSDs to be locked to let it continue conviction accrual. However, the amount of FSDs specified for locking are debited twice from the user leading to fund loss for user. This, in...

Potential manipulation of moneyMarket.incomeIndex

Handle cmichel Vulnerability details Vulnerability Details The DInsterest contract relies on moneyMarket.incomeIndex to return the accurate index. For some implementations, like in yearn, this is the price per share token vault.pricePerShare. There might be cases where this price per share can be...

transferERC721 doesn't clean timelockERC721s

Handle gpersoon Vulnerability details Impact The function transferERC721 works similar to the functions timeUnlockERC721 with timelocked NFT's. However timeUnlockERC721 cleans timelockERC721s delete timelockERC721skey;, while transferERC721 doesn't clean timelockERC721s This could mean that...

Code different from comment

Handle s1m0 Vulnerability details Impact The formula doesn't coincide with the comment. Proof of Concept Tools Used Manual analysis. Recommended Mitigation Steps Correct the code or the comment. --- The text was updated successfully, but these errors were encountered: All reactions...

Handle transfers of different ERC20 tokens

Handle paulius.eth Vulnerability details Impact Some ERC20 transfers have require checks, e.g.: requireiERC20token.transfermember, amount; some don't, e.g.: iERC20token.transferrecipient, amount; It is a good practice to think about all the possible variations of ERC20s see: . Recommended...

Unrestricted access to lockUnits allows an attacker to steal funds from any user.

Handle shw Vulnerability details Impact The lockUnits and unlockUnits functions in Pools.sol allow anyone to call without any restrictions or access control on the caller. An attacker can steal any user's member units by directly calling lockUnits. Proof of Concept Referenced code:...

Initialization can be front-run in USDV.sol

Handle 0xRajeev Vulnerability details Impact Given the public access, this is susceptible to front-running by an attacker who can initialize this with arbitrary assets before the deployer. Reinitialization will require contract redeployment because initialization can be done only once. Reference:...

Missing checks if pairs equal tokens

Email address [email protected] Handle @cmichelio Eth address 0x6823636c2462cfdcD8d33fE53fBCD0EdbE2752ad Vulnerability details The UniswapStyleLib.getAmountsOut, PriceAware.setLiquidationPath and others don't check that path.length + 1 == tokens.length which should always hold true. Also, it does n...

Example finding from form

Email address [email protected] Handle adamavenir Eth address 234234234 Vulnerability details Some details: detailsschmetails Impact Brace for it! Proof of concept proof of concept Tools used I used no tools. Just this form and my BARE HANDS Recommended mitigation steps I would recommend not doing...

collateralizeWLp can be bypassed even when collateralization is paused

Lines of code Vulnerability details Impact Admin can pause collateralization for a specific mode to prevent users from providing more collateral either via collateralize or collateralizeWLp. However, due to not properly using internal accounting when tracking wLP collateral, users can still provi...

Array is push()ed but not pop()ed, and is iterated over

Lines of code 96, 485, 485, 485, 485, 485, 485, 485, 485, 485, 485https://github.com/Tapioca-DAO/ta...

Small positions are allowed in the system that are not profitable for liquidators

Lines of code Vulnerability details Proof of Concept When someone borrows, then he can borrow any assets amount that he would like. In the end function will check that position is healthy, which means that user has enough collateral amount to cover borrowed amount. The problem is that this functi...

In case if wLP will be blacklisted then user will not be able to withdraw it

Lines of code Vulnerability details Proof of Concept When users deposit wLP tokens as collateral, then they are checked to be whitelisted. Later, it's possible that for some reason wLP token will be backlisted by governor. And once it's done, then users, who already used that wLP tokens as...

testing discord integration

Lines of code L1 Vulnerability details TEST --- The text was updated successfully, but these errors were encountered: All reactions...

addRewardToken() does note remove old entries before adding new ones

Lines of code 455, 280, 378, 411 Vulnerability details Each time addRewardToken is called, new entries are added to the array, but doing so does not remove any old entries. By calling the function multiple times, an attacker can can increase their voting power indefinitely, without having to...

_safeMint() should be used rather than _mint() wherever possible

Lines of code 139, 178, 204 Vulnerability details mint is discouraged in favor of safeMint which ensures that the recipient is either an EOA or implements IERC721Receiver. Both OpenZeppelin and solmate have versions of this function. In the cases below, mint does not call...

Return values of approve() not checked

Lines of code 321, 215, 184, 450, 761, 217, 157, 234, 339, 386https://github.com/Tapioca-DAO/t...

Ocean.doMultipleInteractions() cannot wrap ether

Lines of code Vulnerability details Bug Description doMultipleInteractions in Ocean.sol attempts to wrap ether but reverts due to a logical error. The internal helper function, doMultipleInteractions, includes the following: if msg.value != 0 balanceDeltas.increaseBalanceDeltaWRAPPEDETHERID,...

Limited functionality due to Primitive's balance being decreased before it is called

Lines of code Vulnerability details Impact In the current implementation, the balance of a primitive is decreased burned before it is called. This requires the primitive to hold outputAmount of outputToken before a transaction, which severely restricts the functionality it can provide and has no...

Batch Execution Failure

Lines of code Vulnerability details Impact A failure in one interaction could potentially cause the entire batch to fail, affecting subsequent interactions. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates...

Compute Type Determination

Lines of code Vulnerability details Impact The determineComputeType function reverts if the input and output tokens do not match expected pairs. This could lead to failed transactions if new token pairs are introduced without updating the function. Proof of Concept Provide direct links to all...

Upgraded Q -> 2 from #304 [1701018148851]

Judge has assessed an item in Issue 304 as 2 risk. The relevant finding follows: Incorrect minTotalContribution and minContribution Interaction --- The text was updated successfully, but these errors were encountered: All reactions...

there is rounding error when price is below 10

Lines of code Vulnerability details Impact fee will be zero when price is below in get minting price Proof of Concept uint256 public constant NFTFEEBPS = 1000; function getNFTMintingPriceuint256 id, uint256 amount public view returns uint256 fee address bondingCurve = shareDataid.bondingCurve;...

Attacker can Grief The Call to depositAsset Making It Impossible For The Victim To Deposit

Lines of code Vulnerability details Impact The attacker can grief the victim , making him unable to deposit asset into the pool. Proof of Concept The attack flow is as follows - Alice decides to deposit assets into the LRTDepositPool.sol , she calls depositPool here At L152 the function makes the...

Failure to Initialize Default Price Feeds Can Cause Unexpected Reverts

Lines of code Vulnerability details Impact The ChainlinkPriceOracle contract does not initialize default price feed mappings for supported assets. This means calling the getAssetPrice function before explicitly setting a feed will result in a revert instead of a defined failure response. Details:...

Missing gas fee limit

Lines of code Vulnerability details The use of .callvalue: balance"" does not limit the gas sent along with the Ether, potentially allowing all gas in the transaction to be used by the receiver. // Set a specific gas limit for the call if applicable uint256 gasLimit = someGasLimit; // Define...

Input validation for the fields within opts (like opts.name, opts.symbol, opts.voteDuration, etc.) is necessary to ensure they meet the expected criteria.

Lines of code Vulnerability details M3 - Input validation for the fields within opts like opts.name, opts.symbol, opts.voteDuration, etc. is necessary to ensure they meet the expected criteria. poc: solidity function createParty private returns Party requirebytesopts.name.length 0, "Party name is...

Increasing of totalVotingPower during crowdfund can lead to users losing funds.

Lines of code Vulnerability details Bug Description The recent code update allows authorities to be declared at the start of the crowdfunding phase. This change allows authority-restricted functions to be called during the crowdfunding phase by the authorities added in the party constructor...

Upgraded Q -> 3 from #369 [1699544960870]

Judge has assessed an item in Issue 369 as 3 risk. The relevant finding follows: L-01 Controller can’t call setMaxTotalSupply due to lack of function to do it. --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 3 from #161 [1699466057671]

Judge has assessed an item in Issue 161 as 3 risk. The relevant finding follows: L-02 Prime.updateScores will revert if users are added after updating nextScoreUpdateRoundId Vulnerability Details In Prime contract: the updateScores function is meant to update scores of a batch of users when a new...

Vesting amount is calculated incorrectly in StakedUSDe contract

Lines of code Vulnerability details Description The description says vestingAmount is the contract balance + any unvested remainder at that time but it is set incorrectly in the code. /// @notice The amount of the last asset distribution from the controller contract into this /// contract + any...

ERC20 tokens can be incorrectly burnt because of insufficient validation

Lines of code Vulnerability details Impact ERC20 tokens are incorrectly burnt. Proof of Concept In the file WildcatSanctionsEscrow.sol there is a constructor function: constructor sentinel = msg.sender; borrower, account, asset = WildcatSanctionsSentinelsentinel.tmpEscrowParams; Let's suppose thi...

M-07 Unmitigated

Lines of code Vulnerability details Mitigation of M-07: Issue NOT fully mitigated with ERROR Mitigated issue M-07: Lack of access control and value validation in the reward flow exposes functions to public access The issue was that anyone can deposit rewards to AfEth, and that if AfEth or...

failed imports

Lines of code Vulnerability details Impact Unable to comply correctly Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used manual and slither Recommended Mitigation Steps install...

Centralisation risk

Lines of code Vulnerability details Impact The protocol has a onlyGovernor role with privileged rights to perform administrator tasks that can affect users. Proof of Concept The governorhave control over crucial function that can be updated and change according to the governor discretion. functio...

SafeDeployer.sol : Missing the correct type caste for _WALLET_REGISTRY_HASH when setup the console account could lead issue in accessing the functions from WalletRegistry

Lines of code Vulnerability details Impact Incorrect address type caste would lead to setting the console account which can not access the function from WalletRegistry.sol. Proof of Concept The SafeDeployer contract facilitates the deployment of Gnosis Safe accounts and configuring them as consol...

the nonce value is not increasing everytime

Lines of code Vulnerability details Impact the nonce value is not increasing everytime The nonce value is used to create the TypeHashHelper.Transaction struct that's passed to the buildTransactionStructHash function. The actual value of executorNonceexecRequest.accountexecRequest.executor is...

ExecutorPlugin.executeTransaction() is prone to cross-chain replay attacks.

Lines of code Vulnerability details The function executeTransaction is used by executors to validate and execute transactions via a module transaction. the function takes in the input ExecutionRequest and does no validation of the msg.sender. therefore this creates an opening in which a malicious...

TransactionValidator does not validate gas token address and gas price parameter when validating the transaction

Lines of code Vulnerability details Impact TransactionValidator does not validate gas token address and gas price parameter when validating the transaction Proof of Concept the safe transaction struct is listed below: struct SafeTransactionParams Enum.Operation operation; address from; address to...

Console account cannot execute a transaction on a sub account unless it registers itself as an executor

Lines of code Vulnerability details The Executor is an account authorized to make module transactions on a subAccount via ExecutorPlugin. The executor is assigned/registered by the subaccount created by the console account. But the console account itself cannot execute the transaction & is...

ENS (ERC20Votes) token transferred to the proxy contract will be lost forever.

Lines of code Vulnerability details Impact ENS ERC20Votes token transferred to the proxy contract will be lost forever. As delegation amount is out of sync with the ERC1155 balance if the ENS token is transferred to the proxy contract. Proof of Concept When the user delegates 100 tokens to A, the...

token.transferFrom signaling failure by returning false may allow for funds to be stolen

Lines of code Vulnerability details Impact ERC20MultiDelegate is expected to work with any ERC20-compliant tokens as long as they provide the same functionality and interface as ERC20Votes from OpenZeppelin. This makes it possible for ERC20MultiDelegate to work with a token that signals...

Loss of tokens because target address can be set to zero

Lines of code Vulnerability details Impact Due to the possibility of target addresses being zero, tokens transferred to zero address will be lost forever, leading to loss of funds for the users of the protocol and that tokens being out of circulation forever burned. Proof of Concept Users can...

LiquidityMining.initTickTracking() called by MarketSequencer.initCurve() Check if the liquidity curve for the pool is already initialized.

Lines of code Vulnerability details MarketSequencer.initCurve can call LiquidityMining.initTickTracking any number of times, because their is no restriction for reinitialization. As stated in the comment section, putting the caller in charge of not reinitializing can lead to an unintentional...

accrueConcentratedPositionTimeWeightedLiquidity may revert under special situations

Lines of code Vulnerability details Impact LiquidityMining.accrueConcentratedPositionTimeWeightedLiquidity may unintentionally reverts and make transactions does not succeed Proof of Concept The LiquidityMining.accrueConcentratedPositionTimeWeightedLiquidity function calculates the concentrated...

A Malicious user can create a rootBridgeAgent with a malicious endpoint and execute calls directly with the rootBridgeAgent.

Lines of code Vulnerability details Impact A Malicious user can create a rootBridgeAgent with a malicious endpoint and execute calls directly with the rootBridgeAgent. Since anyone can create a rootBridgeAgent with desired values for port, endpoint and router address in anychain. The Attacker can...

ChainLink should be used as an Oracle for messaging instead of Google Cloud

Lines of code Vulnerability details Impact Each User Application contract e.g. BranchBidgeAgent built on LayerZero will work without configuration using defaults, but a UA will also be able to configure its own. Maia intends to use the default config. However, Google Cloud Oracle is the default a...

Validate poolIdx input to prevent storage corruption in critical functions.

Lines of code Vulnerability details Impact No validation on poolIdx input for key functions like claimConcentratedRewards. Could pass invalid poolId and corrupt storage. Proof of Concept The claimConcentratedRewards function. It takes in a poolIdx as one of the parameters: function...

payableCall in VirtualAccount isn’t protected by requiresApprovedCaller modifier

Lines of code Vulnerability details Impact due to the lack of access control in payableCall function in VirtualAccount contract, anyone can call payableCall on a user virtual account . An attacker can use this vulnerability to steal the users funds after a failed settlement by the user . Proof of...

Virtual account lacks access control

Lines of code Vulnerability details Impact The Virtual Account lacks access control on a function that allows arbitrary calls. This enables anyone to take any assets contained within the account. Proof of Concept The Virtual account has the requiresApprovedCaller modifier to prevent use from...