Lucene search
+L
Code423n4Most viewed

10190 matches found

Code423n4
Code423n4
added 2023/05/26 12:0 a.m.13 views

AmbireAccount implementation can be destroyed by privileges

Lines of code Vulnerability details AmbireAccount implementation can be destroyed by privileges The AmbireAccount implementation can be destroyed, resulting in the bricking of all associated wallets. Impact The AmbireAccount contract has a constructor that setups privileges, these are essentially...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/26 12:0 a.m.13 views

Project may fail to be deployed to chains not compatible with Shanghai hardfork

Lines of code Vulnerability details Project may fail to be deployed to chains not compatible with Shanghai hardfork Current settings may produce incompatible bytecode with some of the chains supported by the protocol. Impact The Ambire wallet supports and targets different chains, such as Ethereu...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/24 12:0 a.m.13 views

test with new label

Lines of code L1 Vulnerability details test Assessed type CanAuto --- The text was updated successfully, but these errors were encountered: All reactions...

7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/23 12:0 a.m.13 views

Upgraded Q -> 2 from #964 [1684819958119]

Judge has assessed an item in Issue 964 as 2 risk. The relevant finding follows: L1 --- The text was updated successfully, but these errors were encountered: All reactions...

7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/22 12:0 a.m.13 views

transfer() method can lead to re-entrancy attack

Lines of code Vulnerability details Impact The contract in scope has a withdraw function namely ‘uniswapV3SwapCallback’ which sends funds to the calling address. The calling address can be a malicious contract. Currently transfer sends more gas than 2300 creating a potential attack vector for...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/22 12:0 a.m.13 views

arbitrary reservedRate value will result the next swap to be wrongly executed

Lines of code Vulnerability details Impact the function "payParams" will set the variable reservedRate without checking the effective value of that param,in fact if someone decides to call the "payParams" function passing as data.reservedRate a number 10k will result in the next swap that will...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/22 12:0 a.m.13 views

Delegate should check that terminal is operating with ETH as the terminal token

Lines of code Vulnerability details Delegate should check that terminal is operating with ETH as the terminal token The JBXBuybackDelegate implementation is only prepared to operate with ETH as the terminal token. The implementation should check that the JuiceBox terminal matches this case. Impac...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/22 12:0 a.m.13 views

Swap leftovers are locked in the JBXBuybackDelegate

Lines of code Vulnerability details Vulnerability details In case that the project JBToken address is bigger than WETH address, projectTokenIsZero is set to false. The test cases of buyback delegate only cover the situation, where the JBToken is lower than WETH. constructor IERC20 projectToken,...

6.6AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/22 12:0 a.m.13 views

Anyone can front-rundidPay calling payParams to grief swaps and mints

Lines of code Vulnerability details Impact The payParams function in the IJBPayDelegate contract does not currently have any form of access control implemented. This could allow a malicious user to manipulate the mintedAmount and reservedRate state variable, which can interfere with the correct...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/18 12:0 a.m.13 views

Upgraded Q -> 2 from #467 [1684434787599]

Judge has assessed an item in Issue 467 as 2 risk. The relevant finding follows: L-03 Anyone can memorialize other users' position if the owner approves PositionManager There isn't a check to ensure that the caller is the actual owner of the position, so anyone can memorialize a position if the...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/15 12:0 a.m.13 views

PLACEBID() IN SHORTFALL.SOL MAY LEAD TO DENIAL OF SERVICE AND FRONT RUNNING ATTACKS

Lines of code Vulnerability details Impact The Shortfall.placeBid function in the Venus protocol exhibits potential vulnerabilities that may lead to denial-of-service DoS and front-running attacks. A malicious actor could exploit these vulnerabilities to disrupt the auction process, manipulate...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/15 12:0 a.m.13 views

First 1 wei deposit can produce lose of user xETH funds in wxETH

Lines of code Vulnerability details Description The present implementation of the wxETH::stake functions permits the sending of tokens to the contract, even if the quantity of wxETH is zero. This can result in users losing funds, particularly when the initial deposit is only 1 wei, and the extent...

6.6AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/15 12:0 a.m.13 views

Incorrectly calculation of the total tokens to be seized because of the difference on the scale of magnitude for the prices of the underlying assets

Lines of code Vulnerability details Impact The total number of tokens to be seized could be wrongly calculated if the underlying assets of vTokenBorrowed & vTokenCollateral have a different decimals. Proof of Concept The price returned by the ChainlinkOracle contract of the Venus Protocol, the...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/15 12:0 a.m.13 views

Unfair handling of rewards for users with a high amount of rewards

Lines of code Vulnerability details Users can claim their rewards in RewardDistributor.claimRewardToken. The reward handling part is done in grantRewardToken: 416: function grantRewardTokenaddress user, uint256 amount internal returns uint256 417: uint256 rewardTokenRemaining =...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/15 12:0 a.m.13 views

Rebalance amounts should be checked so that updated balances falls within thresholds

Lines of code Vulnerability details Rebalance amounts should be checked so that updated balances falls within thresholds Rebalance operations are allowed when the current percentage of xETH in the Curve pool is outside the defined thresholds. However, there is no check to ensure that the amount o...

6.6AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/15 12:0 a.m.13 views

Potential Division by Zero in utilizationRate method

Lines of code Vulnerability details Impact In the case where cash + borrows - reserves equals 0, the function would try to divide by zero which will result in a runtime error. Proof of Concept An attacker might manipulate the state of the contract to where cash + borrows - reserves equals zero...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/11 12:0 a.m.13 views

Incorrect Calculation of Max Amount of Quote Tokens in moveLiquidity() Function in PositionManager.sol.

Lines of code Vulnerability details Impact The updateInterest function is called before retrieving the fromPosition value from positionsparams.tokenIdparams.fromIndex in the moveLiquidity function. This means that the bucketDeposit value may not reflect the current accrued interest, which can...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/11 12:0 a.m.13 views

Race condition vulnerability in positionManager minting function

Lines of code Vulnerability details Impact race condition vulnerability can result in the issuance of duplicate token IDs. When multiple transactions are executed in quick succession attempting to mint tokens, they may end up being assigned the same ID due to a shared counter or variable used to...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/11 12:0 a.m.13 views

An expired parameter is required because there may be slippage in the calculation.

Lines of code Vulnerability details Impact Due to changes in interest rates, failure to process transactions in a timely manner may result in missing out on ideal rewards. Proof of Concept The calculation of the clainRewards function involves interest rates, which are variable. If...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/10 12:0 a.m.13 views

Upgraded Q -> 2 from #49 [1683711003164]

Judge has assessed an item in Issue 49 as 2 risk. The relevant finding follows: QA9. hexStringToBytes32 fails to check that range idx, lastIdx is within 32 bytes range and thus the returned r will fit into bytes32. Mitigation: Introduce the check: function hexStringToBytes32 bytes memory str,...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/08 12:0 a.m.13 views

Mitigation Confirmed for Mitigation of M-10: Issue mitigated

Mitigated issue M-10: Stuck ether when use function stake with empty derivativesderivativeCount = 0 The issue was that stake will accept payment but not issue safETH when derivativeCount == 0 or when all weightsi == 0. Mitigation review The proposed mitigation simply adds a requirederivativeCount...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/08 12:0 a.m.13 views

Mitigation Confirmed for NEW

Note: Issue has not actually been resolved but for some reason I can't get my issues to submit without "Mitigation confirmed no new vulnerabilities detected" checked so I am doing this as a work around Severity Medium Lines of code Impact Contract still assumes 1:1 peg for stETH in WstETHwithdraw...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/04 12:0 a.m.13 views

Upgraded Q -> 3 from #853 [1683219256548]

Judge has assessed an item in Issue 853 as 3 risk. The relevant finding follows: LC-02 USE THE SAFECAST LIBRARY FOR CASTING VALUES TO AVOID OVERFLOW/UNDERFLOW File: virtualBaseTokenReserves += uint128netInputAmount - feeAmount - protocolFeeAmount; virtualNftReserves -= uint128weightSum; --- The...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/04 12:0 a.m.13 views

Context not implemented as per need of the code

Lines of code Vulnerability details Impact Logical and mathematical flaws might occur due to lack of the check . Proof of Concept As per comment in: //check if the withdrawal occured after mostRecentWithdrawalBlockNumber but no check is involved in the code which would cause mathematical flaws in...

7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/04 12:0 a.m.13 views

BEACON CHAIN VALIDATOR COULD SELF RESCUE WHEN OPERATOR IS FROZEN

Lines of code Vulnerability details Impact The modifier onlyNotFrozen is intuitive such that the staker will be frozen when the delegated operator is frozen. However, not utilizing it in recordOvercommittedBeaconChainETH and undelegate could allow the Beacon Chain validator to undelegate from the...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/04 12:0 a.m.13 views

Slashing can be frontrunned

Lines of code Vulnerability details Proof of Concept When attempting to withdraw funds, the user calls queueWithdrawal first. queueWithdrawal checks that the caller is not frozen, then marks the withdrawal as pending. function queueWithdrawal uint256 calldata strategyIndexes, IStrategy calldata...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/04 12:0 a.m.13 views

Vulnerability in Pause Function

Lines of code Vulnerability details Impact An attacker can exploit this vulnerability by setting any value as the new paused status code, which can allow the attacker to circumvent the pausing restrictions and carry out unauthorized actions on the contract. This can lead to significant consequenc...

7.1AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/04 12:0 a.m.13 views

Users can avoid getting their queuedWithdrawal slashed because of the wrong implementation.

Lines of code Vulnerability details Impact Users can avoid getting their queuedWithdrawal slashed because of the wrong implementation. Proof of Concept Let's take a look at the following code snippet from StrategyManagerslashQueuedWithdrawal. // keeps track of the index in the indicesToSkip array...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/04 12:0 a.m.13 views

Staker can bypass the debt accrued via beaconChainETHSharesToDecrementOnWithdrawal by transferring shares to another address

Lines of code Vulnerability details Description When a staker is verified to have over-committed and the over-committed amount is greater than their outstanding shares, they accrue a debt that is captured by beaconChainETHSharesToDecrementOnWithdrawal. This debt eventually gets settled when the...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/03 12:0 a.m.13 views

Upgraded Q -> 2 from #898 [1683143849953]

Judge has assessed an item in Issue 898 as 2 risk. The relevant finding follows: Royalty receiver will not get correct royalty as saleprice is not calculated properly uint256 salePrice = outputAmount / sellsi.tokenIds.length; Here the salesprice for an nft is calculated by using the above formula...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/05/02 12:0 a.m.13 views

Upgraded Q -> 2 from #882 [1683052827510]

Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: changeFeeQuote reverts for tokens with decimals less than 4 --- The text was updated successfully, but these errors were encountered: All reactions...

7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/28 12:0 a.m.13 views

Missing important check in getOwnerAddress() function in DNSClaimChecker.sol

Lines of code Vulnerability details Impact getOwnerAddress function used in DNSClaimChecker.sol is missing important check on the type and class of the records. Also this getOwnerAddress function is used in DNSRegistar.sol claim function to claim a name using the given proofs Since there are chec...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/28 12:0 a.m.13 views

The resolver address is redeclared in the "proveAndClaimWithResolver" function, which may cause a potential vulnerability.

Lines of code Vulnerability details Impact The vulnerability may allow an attacker to use a different address and potentially exploit the system for their own gain Proof of Concept address public immutable resolver; The proveAndClaimWithResolver function redeclares the resolver variable even thou...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/27 12:0 a.m.13 views

SHA1Digest Contract Vulnerability

Lines of code Vulnerability details Impact The vulnerability is related to the use of the SHA1 hashing algorithm in the SHA1Digest contract. SHA1 is an outdated cryptographic hash function that has been deprecated by most security experts due to its weaknesses and susceptibility to collision...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/27 12:0 a.m.13 views

Upgraded Q -> 2 from #883 [1682591284215]

Judge has assessed an item in Issue 883 as 2 risk. The relevant finding follows: This could cause stake and unstake to permanently revert for an prolonged period of time, as it is possible for deposit and withdraw to revert due to unchecked external conditions: Reth The rocket pool DAO can disabl...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/21 12:0 a.m.13 views

Test for emails sent from api - and manage findings

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...

7.1AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/19 12:0 a.m.13 views

An attacker whose a 3% shareholder can wipe-out all the tokens of anyone using a flash-loan

Lines of code Vulnerability details Impact A 3% votes holder can wipe the equity of any other holder using the restructureCapTable function. Proof of Concept 1. a Be a 3% votes holder or have helpers that together have 3% 2. b Reduce the equity to be less than MINIMUMEQUITY This could be done by...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/19 12:0 a.m.13 views

Challenges can be frontrun with de-leveraging to cause lossses for challengers

Lines of code Vulnerability details Impact Challenges, once created, cannot be closed. Thus once a challenge is created, the challenger has already transferred in a collateral amount and is thus open for losing their collateral to a bidding war which will most likely close below market price, sin...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/19 12:0 a.m.13 views

Unrestricted Token Transfer and Minting

Lines of code Vulnerability details Impact An attacker could exploit this vulnerability to mint an unlimited number of tokens, potentially devaluing the token and manipulating the market. Proof of Concept: Proof of Concept --The contract allows anyone to call the onTokenTransfer function without...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/19 12:0 a.m.13 views

function restructureCapTable() in Equity.sol not functioning as expected

Lines of code Vulnerability details Impact Incorrect typo in function restructureCapTable leading to only burning tokens of first address of addressToWipe array arguement. Proof of Concept Here, in L313, addressToWipe0 only takes first address of the array. While ignoring the rest and also since...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/19 12:0 a.m.13 views

POSITION LIMIT COULD BE FULLY REDUCED TO ZERO BY CLONES

Lines of code Vulnerability details Impact A newly opened position could have its limit fully reduced to zero as soon as the cooldown period has elapsed. Proof of Concept As seen in the function below, a newly opened position with 0 Frankencoin minted could have its limit turn 0 if the function...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/19 12:0 a.m.13 views

Minter and position privileges allow unrestricted minting and burning of arbitrary tokens

Lines of code Vulnerability details Any registered minter and a position belonging to him have absolute control of minting and burning tokens on all accounts. Impact New minting mechanisms are subject to governance approval i.e. can be veto’ed. These, however, will be arbitrary contracts with...

7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/19 12:0 a.m.13 views

The minter can steal the Frankencoin in notifyLoss()

Lines of code Vulnerability details Impact The minter can steal the Frankencoin in notifyLoss because of In this code: if reserveLeft = amount transferaddressreserve, msg.sender, amount; The minter can call the function notifyLoss Constantly. When reserveLeft = amount, the minter who call the fir...

6.9AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/19 12:0 a.m.13 views

Reentrancy Attack Vulnerability in StablecoinBridge Contract

Lines of code Vulnerability details Impact The vulnerability can potentially drain the funds of the contract by allowing an attacker to repeatedly call the mint or burn functions and re-enter the mintInternal or burnInternal functions before they complete. Proof of Concept To deploy the...

7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/19 12:0 a.m.13 views

Lack of removal of minters reduces chances of survival

Lines of code Vulnerability details Impact It is reasonable to assume there will be occasions of misbehaving minters that will threaten the functioning of the Frankencoin ecosystem and there is no way to disable any such minter without redeploying the contract. Ex. an attacker can deploy a...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/14 12:0 a.m.13 views

ETHCrowdfundBase#_calculateRefundAmount can return too many funds to users and brick refunds

Lines of code Vulnerability details Impact Malicious user can honeypot and grief users causing loss of funds Proof of Concept ETHCrowdfundBase.solL227-L230 if fundingSplitRecipient != address0 && fundingSplitBps 0 uint96 feeAmount = amount fundingSplitBps / 1e4; amount -= feeAmount; When a user...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/14 12:0 a.m.13 views

Use of _mint in ReraiseETHCrowdfund#_contribute is incompatible with PartyGovernanceNFT#mint

Lines of code Vulnerability details Impact Misconfigured receiver could accidentally DOS party Proof of Concept ReraiseETHCrowdfund.solL238 if previousVotingPower == 0 mintcontributor; - @audit-issue standard minting here ReraiseETHCrowdfund.solL374 uint256 tokenId = party.mintcontributor,...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/13 12:0 a.m.13 views

Voters can call VetoProposal.voteToVeto() as many times as they like.

Lines of code Vulnerability details Impact Each voter can veto a proposal if they want by calling voteToVeto several times to pass the passThresholdBps. Proof of Concept Every voter shouldn't vote several times, otherwise, the voting system will be broken. But voteToVeto doesn't check the already...

6.8AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/13 12:0 a.m.13 views

Possible DOS attack using dust in ReraiseETHCrowdfund._contribute()

Lines of code Vulnerability details Impact Normal contributors wouldn't contribute to the crowdfund properly by a malicious frontrunner. Proof of Concept When users contribute to the ReraiseETHCrowdfund, it mints the crowdfund NFT in contribute. File:...

6.7AI score
SaveExploits0
Code423n4
Code423n4
added 2023/04/08 12:0 a.m.13 views

OperatorProposal.sol: Leftover ETH is not refunded to the msg.sender

Lines of code Vulnerability details Impact The OperatorProposal contract is a type of proposal that allows to execute operations on contracts that implement the IOperator interface. Upon execution of the proposal it might be necessary that the executor provides ETH. This is true especially when...

7.1AI score
SaveExploits0
Total number of security vulnerabilities5000