User ETH will be stacked on Executor contract if the target script doesn't handle ETH.

Lines of code Vulnerability details Description When user wants to execute an action, he must send ETH equal to the actionInfo.value, this ETH should be forwarded to executor.execute contract. Note: the function currently does't forward the ETH, it's explained on another issue 48, the fix is to...

Success value and msg.value not checked in llamaExecutor.sol

Lines of code Vulnerability details Impact Success value not checked. Result can fail silently. Msg.value can be lost. Proof of Concept Function execute does not check the validity of success. If execute is called and msg.value is greater than value, then excess msg.value will be stucked in...

Blacklisted Address Can Exploit the Exchange

Lines of code Vulnerability details Impact Addresses that are blacklisted for popular ERC20 tokens such as USDC, USDT can be leveraged to exploit the exchange in a number of ways. These addresses cannot be liquidated in any case where they would be transferred back a leftover collateral amount in...

ERC721 tokens can be forever locked when transferring

Lines of code Vulnerability details Impact An action that transfers ERC721 tokens from the account contract to another contract could result in the ERC721 tokens being locked forever if the receiving contract doesn't support receiving ERC721 tokens. Proof of Concept The LlamaAccount contract uses...

expirationPeriod in the strategy contracts is not checked when calling LlamaCore.execute

Lines of code Vulnerability details Impact If executionPeriod is set to an extremely short time or even 0, then all actions can never be executed. Proof of Concept There are 7 states in an Action flow: Active, Canceled, Failed, Approved, Queued, Expired, Executed. Generally, the sequence goes lik...

Uses Send Value to transfer Native token instead of Transfer Function

Lines of code Vulnerability details Impact The Send Value is susceptible to a reentrancy attack. Proof of Concept If the recipient is a malicious contract that performs a reentrant call back into the LlamaAccount contract, it can execute code before the transfer is completed and potentially...

[ H ] In executeAction function, ETH can remain stuck after reverting due to a failed call.

Lines of code Vulnerability details Impact If and when the executeAction function reverts at either of the checks, the amount of ETH sent along with the call will be locked in the contract forever, with no current measures of recovery. Proof of Concept executeAction is called, but the call fails ...

Missing Role Validation in LlamaAbsoluteStrategyBase.sol

Lines of code Vulnerability details Bug Description: The LlamaAbsoluteStrategyBase contract serves as a base contract for Llama strategies and implements various functions for action creation, approval, disapproval, and cancellation. However, it fails to validate the roles used in some critical...

Inconsistent Use of Error Handling in LlamaAccount Contract

Lines of code Vulnerability details Description: The LlamaAccount contract contains a bug that allows an attacker to execute arbitrary calls with the delegatecall opcode, which can lead to unintended consequences and potential security vulnerabilities. Steps to Reproduce: Deploy the LlamaAccount...

The owner is a single point of failure and a centralization risk.

Lines of code Vulnerability details Impact & Vunerability Details. Having a single EOA as the only owner of contracts is a large centralization risk and a single point of failure, as this contract's owner can perform roles of high importance to the protocol. A single private key may be taken in a...

No stale data check on data being read from POR feed

Lines of code Vulnerability details Impact Stale data of exchange rate data being used protocol, resulting in loss in terms of ETHX being minted at stale exchange rate which won't have accounted for new reward Recommended Mitigation Steps Check lastUpdatedAt timestamp and that it is within...

FRONT-RUNNING SUSCEPTIBILITY IN ADDBID()

Lines of code Vulnerability details Impact Auction.addBid is susceptible to front-running attacks. This vulnerability presents a significant risk as participants with adequate knowledge or skill could manipulate Ethereum transaction ordering to gain undue advantage, potentially compromising the...

Tokens can be lost when trying to deposit in SDCaollateral.depositSDAsCollateral() or trying to withdraw SDCaollateral.withdraw()

Lines of code Vulnerability details Impact Some tokens do not return the success of the token submission. Because Since we don’t know for sure how the SD token is implemented, we need to take this into account. Proof of Concept A detailed example is listed in: Tools Used Manual audit Recommended...

Lack of Event Signature Verification

Lines of code Vulnerability details Impact The functions submitExchangeRateData, submitSDPrice, and submitValidatorStats emit events without verifying the signature of the calling contract. Malicious contracts can exploit this by emitting events with misleading information, potentially deceiving...

Oracle timeout at rebalance will result in a sell-off of all RSRs at 0 price

Lines of code Vulnerability details When creating the trade for rebalance, the RecollateralizationLibP1.nextTradePair uses uint192 low, uint192 high = rsrAsset.price; // UoA/tok to get the rsr sell price. And the rsr assert is a pure Assert contract, which price function will just return 0, FIXMA...

Oracle data is not sufficiently validated

Lines of code Vulnerability details Impact The retrieved price from the oracle can be stale value or outdated and used anyways as a valid data. The usage of such data can impact on how the further logics of that price are implemented. Proof of Concept File: StaderOracle.sol function getPORFeedDat...

User with large stacked ETH can deny other stacker from withdrawing.

Lines of code Vulnerability details Description The withdraw flow of Stader splitted in two steps, first the user has to requestWithdraw by passing his owned ETHx amount which add a new record to userWithdrawRequestsnextRequestId, second, finalizeUserWithdrawalRequest got called by any user to...

cancelUnstake lack payoutRewards before mint shares

Lines of code Vulnerability details cancelUnstake will cancel the withdrawal request in the queue can mint shares as the current stakeRate. But it doesn't payoutRewards before mintStakes. Therefor it will mint stRsr as a lower rate, which means it will get more rsr. Impact Withdrawers in the...

accountsMap[ADMIN] not set in initialize function of StaderConfig contract

Lines of code Vulnerability details Impact When initializing the StaderConfig contract with the initialize function, the admin address is not set in accountsMapADMIN variable, so the getAdmin function will return address0. This will cause the loss of the ownership of the VaultProxy contract as it...

[M-02] Not having Self-Destruct Functions

Lines of code Vulnerability details Impact The contract does not have a self-destruct function, making it impossible to remove the contract from the blockchain once it's deployed. Recommended Mitigation Steps add a self-destruct function with proper access control to allow the contract to be...

Upgraded Q -> 2 from #9 [1685982867794]

Judge has assessed an item in Issue 9 as 2 risk. The relevant finding follows: Users might lose funds after calling rageQuit by malicious frontrunners. --- The text was updated successfully, but these errors were encountered: All reactions...

4 issues in the L2CrossDomainMessenger.relayMessage() function. Described one after other.

Lines of code Vulnerability details Impact 1. Loss of funds. 2. Unpermitted function calls. Proof of Concept 1. The function proceeds only if successfulMessagesxDomainCalldataHash is false require successfulMessagesxDomainCalldataHash == false, "Provided message has already been received." ; but...

Attacker can use buyNftFromMarket() to buy an NFT from an arbitrary collection

Lines of code Vulnerability details Impact The function buyNftFromMarket allows a borrower to buy an NFT from the same collection to repay a loan. At the end of the function flow, it checks that the contract actually holds the NFT tokenId and assumes that it is the acquired NFT. However, this is...

_execSellNftToMarket() re-enter steal funds

Lines of code Vulnerability details Impact re-enter steal funds Proof of Concept execSellNftToMarket The number of changes in the balance to represent whether the corresponding amount has been received function execSellNftToMarket address collection, uint256 tokenId, uint256 amount, bool pushBase...

Borrowers can still close loan normally while being defaulted

Lines of code Vulnerability details Borrowers can still close loan normally while being defaulted A borrower can repay a loan normally while having outstanding debt and close it causing losses to the lender. Impact Loans in the Particle protocol are subject to an interest rate defined by the...

Lender can auction the loan without any restriction to cause losses to the borrower

Lines of code Vulnerability details Lender can auction the loan without any restriction to cause losses to the borrower Impact The lender can unilaterally decide to auction a loan at any time, without any restriction. The process can be started by calling startLoanAuction and offers to repay the...

Unspent WETH is not considered in buyNftFromMarket()

Lines of code Vulnerability details Unspent WETH is not considered in buyNftFromMarket Impact In the buyNftFromMarket function, the borrower buys an NFT in order to repay and close their loan. The purchase is executed in the internal function named execBuyNftFromMarket. 395: function...

Supplying NFT, which is borrowed from Particle Exchange, to Particle Exchange can cause original lien's borrower to lose such NFT and previously sent msg.value even though its position for original lien is not yet insolvent

Lines of code Vulnerability details Impact After a borrower calls the following ParticleExchange.swapWithEth function, the borrower receives the corresponding NFT. function swapWithEthLien calldata lien, uint256 lienId external payable override validateLienlien, lienId ... /// @dev cannot instant...

Borrower can block being defaulted or auctioned

Lines of code Vulnerability details Borrower can block being defaulted or auctioned The borrower can potentially block the liquidation and auction processed by using a contract and reverting on ETH transfers. Impact When a loan is being liquidated or auctioned, any credit still available to the...

Burning an NFT can be used to block voting

Lines of code Vulnerability details Burning an NFT can be used to block voting Impact A new validation in the accept function has been introduced in order to mitigate a potential attack to the party governance. By burning an NFT, a party member can reduce the total voting power of the party just...

Possible overflow in PartyGovernance._isUnanimousVotes()

Lines of code Vulnerability details Impact Proposals can't be executed if totalVotes = 8e24. Furthermore, if emergencyExecuteDisabled == true and rageQuitTimestamp == DISABLERAGEQUITPERMANENTLY, users can't take out the funds from the party forever. Proof of Concept In isUnanimousVotes, it...

test with new label

Lines of code L1 Vulnerability details test Assessed type CanAuto --- The text was updated successfully, but these errors were encountered: All reactions...

TEST Med

Lines of code L1 Vulnerability details test medium Assessed type Access Control --- The text was updated successfully, but these errors were encountered: All reactions...

REENTRANCY IN THE ERC777 PROJECT TOKEN, CAN LEAD TO INCONSISTENT STATE OF THE CONTRACT DURING TRANSACTION

Lines of code Vulnerability details Impact In the JBXBuybackDelegate.swap function there is a possbile reentrancy vulnerability. If the projectToken is a ERC777 token then the data.beneficiary can reenter the contract by calling the JBXBuybackDelegate.payParams external function to mint more...

WETH transfer may fail silently in 'uniswapV3SwapCallback' function and execution may stop without any reverts or notification.

Lines of code Vulnerability details Impact WETH transfer may fail silently in 'uniswapV3SwapCallback' function and execution may stop without any reverts or notification. Proof of Concept In the 'uniswapV3SwapCallback' function There's no checks if the WETH transfer have failed or not . If the...

mintedAmount and reservedRate mutex not working

Lines of code Vulnerability details Impact File: JBXBuybackDelegate.sol 101 / 102 @notice The amount of token created if minted is prefered 103 104 @dev This is a mutex 1-x-1 105 / 106 uint256 private mintedAmount = 1; 107 108 / 109 @notice The current reserved rate 110 111 @dev This is a mutex...

Failure to Check for Existence Before Removal

Lines of code Vulnerability details Impact The moveLiquidity function as described. If the positionIndex.removeparams.fromIndex function call returns false, it means that the specified index was not present in the positionIndex set, and the RemovePositionFailed error is not actually applicable in...

Contracts are vulnerable to fee-on-transfer-token-related accounting issues

Lines of code Vulnerability details Vulnerability details Impact Without measuring the balance before and after the transfer, there's no way to ensure that enough tokens were transferred, in the cases where the token has a fee-on-transfer mechanic. If there are latent funds in the contract,...

Lack of Access Control in claimRewards Function

Lines of code Vulnerability details Impact The calculateNewRewards function should also check whether the rewardsCapped variable is greater than the rewardsClaimedInEpoch variable to ensure that rewards are not claimed that exceed the reward cap, because an attacker could exploit this vulnerabili...

Upgraded Q -> 2 from #298 [1683709930306]

Judge has assessed an item in Issue 298 as 2 risk. The relevant finding follows: L-01 Valid hex string is not decoded correctly by hexStringToBytes32 and reads memory out-of-boundary Links Impact Valid hexadecimal strings are not decoded correctly. Decoding reads out-of-bounds memory returning...

Mitigation of M-12: mitigation error, see comments

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-12: mitigation error, see comments Link to Issue: code-423n4/2023-03-asymmetry-findings150 Comments While the proposed change correctly mitigates the issue, in the sense that it introduces a user controlled slippage for stake...

Upgraded Q -> 3 from #306 [1683219251927]

Judge has assessed an item in Issue 306 as 3 risk. The relevant finding follows: L-01 Consider using OpenZeppelin’s SafeCast library to prevent unexpected overflows when casting from uint256 In the function buy and sell of the contract PrivatePool.sol the function first set the variables...

TEST FINDING

Lines of code Vulnerability details ISSUE FOR TESTING PURPOSES Assessed type Uniswap --- The text was updated successfully, but these errors were encountered: All reactions...

Incorrect implementation of RecordParser.readKeyValue()

Lines of code Vulnerability details Impact RecordParser.readKeyValue returns a wrong value if the terminator not found. This is a fundamental library and any contract using it may experience unexpected errors and problems due to this bug. Proof of Concept The implementation logic of...

Missing important check in getOwnerAddress() function in DNSClaimChecker.sol

Lines of code Vulnerability details Impact getOwnerAddress function used in DNSClaimChecker.sol is missing important check on the type and class of the records. Also this getOwnerAddress function is used in DNSRegistar.sol claim function to claim a name using the given proofs Since there are chec...

Upgraded Q -> 2 from #623 [1682589089611]

Judge has assessed an item in Issue 623 as 2 risk. The relevant finding follows: L‑05 Stuck dust in SafEth contract for division When stake in the contract SafEth some WEIs could be stuck in the contract because the equation uint256 ethAmount = msg.value weight / totalWeight;, in example: ethAmou...

A DNS owner can sell the domain and then regain it back using a signature while he was still the owner of the domain

Lines of code Vulnerability details Impact The buying user would have spent money buying the DNS domain to the previous owner and still not have the DNS domain under their ownership. Proof of Concept A malicious user can: Build a proof for their ownership of a dns domain setting their address in...

A MINTER CAN STOP A QUALIFIED POOL SHARE HOLDER FROM DENYING THE MINTER DURING THE APPLICATION PERIOD BY FRONT-RUNNING THE TRANSACTION

Lines of code Vulnerability details Impact A minter can stop a Qualified pool share holder from denying the minter during the application period by front-running the transaction Consider the following scenario: 1 . Assume minter is User A and Qualified pool share holder is User B. 2 . User A call...

if revertOnFailure is set to false, batchContributeFor doesn't refund properly

Lines of code Vulnerability details Proof of Concept Consider the code for batchContributeFor: function batchContributeFor BatchContributeForArgs calldata args external payable onlyDelegateCall returns uint96 memory votingPowers uint256 numContributions = args.recipients.length; votingPowers = ne...

OperatorProposal._executeOperation() should refund excess ETH

Lines of code Vulnerability details Impact There are excess ETH in OperatorProposal.executeOperation, and it should be refunded. Proof of Concept OperatorProposal.executeOperation runs data.operator.execute with data.operatorValue of ETH. data.operator.execute value: data.operatorValue...