burnFrom

Lines of code github.com/code-423n4/2022-10-thegraph/blob/main/contracts/token/IGraphTokens.solL12 Vulnerability details POC: Function burnFrom does not decrease the allowance, so that is possible for example: Adam to deplete the balance of Bob if Bob allowance to Adam is at least one token by...

Standard policy price matching is flawed

Lines of code Vulnerability details Impact Already placed orders may be highly unlikely able to be matched and executed. An order has to be created specifically for an already existing order with the intent to match and execute it. This severely impedes the functionality of the exchange, wastes...

Critical matching policy logic is unenforced

Lines of code Vulnerability details Impact Malicious order matching. Proof of Concept When being executed two orders are matched using custom matching policies. Certain checks are critical for every order matching. Currently these checks would have to be implemented in the matching policies...

StandardPolicyERC1155.sol doesn't validate the order.amount properly.

Lines of code Vulnerability details Impact StandardPolicyERC1155.sol doesn't validate the order.amount properly. This contract is used to check a policy for matching orders of ERC1155 tokens. But it doesn't check the amount of ERC1155 token properly and traders might lose their funds unexpectedly...

USE OF SOLIDITY VERSION 0.8.14 WHICH HAS KNOWN ISSUES APPLICABLE TO Blur Exchange

Lines of code Vulnerability details Vulnerability details Vulnerability related to ‘Optimizer Bug Regarding Memory Side Effects of Inline Assembly’ ref : Blur Exchange inherits solidity contracts from openzeppelin and these uses inline assembly, and optimization is enabled while compiling...

Wrong amount of ERC1155 token result in loss of funds for buyer

Lines of code Vulnerability details Impact In StandardPolicyERC1155 contract, the amount of ERC1155 token always return 1 instead of amount value in Order struct. The result is when ERC1155 orders is matched, buyers will only receive 1 token even they specify amount 1, which means loss of funds f...

test

Lines of code http://L1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps...

The L1GraphTokenGateway does not work on non-standard compliant tokens like USDT

Lines of code Vulnerability details Vulnerability details The L1GraphTokenGateway function uses the standard IERC20 function for the transfer call and proceeds with a checkReturnCode function to handle non-standard compliant tokens that don't return a return value. However, this does not work as...

Upgraded Q -> M from 193 [1665109261242]

Judge has assessed an item in Issue 193 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

After a swap, user can lose input token amount while receiving no output token amount when output token becomes non-existent

Lines of code Vulnerability details Impact When calling the swap function below, the following safeTransfer function is further called for transferring the corresponding value of token from the pool to the recipient. Note that safeTransfer does not check for the existence of the token contract...

Use of globalState.unlocked state change outside lock modifier allows for Re-entrancy which would cause huge loss to pool

Lines of code Vulnerability details I guess I can put this into one report since the issue affects two seperate functions in a contract. Impact The functions AlgebraPool.swap and AlgebraPool.swapSupportingFeeOnInputTokens attempt to not use the lock modifier to update the globalState.unlocked sta...

Infinity loop can lead to denial of service

Lines of code Vulnerability details Impact Infinity loop can lead to denial of service Proof of Concept Tools Used None. Recommended Mitigation Steps Refactor code if is possible. --- The text was updated successfully, but these errors were encountered: All reactions...

Unprotected address(this) checks allow attacker to delegatecall from another contract to spoof values such as the token balances of AlgebraPool instances

Lines of code Vulnerability details Description: AlgebraPool token balance checks are intended to exclusively read the token balances of the AlgebraPool instance. However, it is possible for an attacker to make a delegatecall into one of the methods reading the token balance, overriding the...

FLASH() FUNCTION HAS STATE UPDATES AFTER A CALLBACK TO MSG.SENDER

Lines of code Vulnerability details In AlgebraPool.sol, the flash function has a callback to the msg.sender in the middle of the function while there are still updates to state that take place after the callback. The lock modifier guards against reentrancy but not against cross function reentranc...

A malicious user can claim and successfuly steal a gobbler NFT token.

Lines of code Vulnerability details Impact A malicious user can claim and successfuly steal a gobbler NFT token in the function claimGobbler. Proof of Concept The function claimGobbler is used from the mintlisted users to claim a gobbler using a merkle proof. However there is no check to ensure...

IntegerOverflow Underflow on AdaptiveFee

Lines of code Vulnerability details The AdaptiveFee uses raw calculation on all functions which are potentially vulnerable to integer Overflow and Underflow. Recommended Mitigation Steps Use Safemath library or Upgrade contract to solidity version above 0.8.0 --- The text was updated successfully...

Gobblers burnt for minting legendary Gobblers can be transferred out from the address zero

Lines of code Vulnerability details Impact The mintLegendaryGobbler function burn standard gobblers by setting their owner to address0 without deleting the getApprovedid. So the original owner can setApproval for himself address and transfer the gobbler token back to any address from the address0...

Upgraded Q -> M from 182 [1664281111530]

Judge has assessed an item in Issue 182 as Medium risk. The relevant finding follows: L00: Usage of transfer to send eth The transfer function has a fixed gas stipend of 2300. If a contract as well as EOA can call the function, it is advised to use call function instead of transfer. Here are...

Cannot Withdraw GOO Accrued In GobblerReserve Contracts

Lines of code Vulnerability details Impact The affected GobblerReserve contract does not implement any functionality to withdraw any accrued GOO. Considering that the community and team addresses in the ArtGobblers contract are going to be newly deployed GobblerReserve contracts, immutable and...

Lack of address check for contract ownership changes

Lines of code Vulnerability details Impact Not Checking for zero address input can cause to lose of ownership by accident . Proof of Concept owner try to change ownership to a zero address and it cause to lose of funds . Tools Used Recommended Mitigation Steps Add a check that address in not zero...

Some users may not be able to withdraw till the end of the rewardsCycle, due to possible underflow in the function beforeWithdraw()

Lines of code Vulnerability details Impact In xERC4626.sol If an underflow occur in the function beforeWithdraw, some users may not be able to withdraw till the end of the rewardsCycle. storedTotalAssets is a cached value of total assets, which will only include the unlockedRewards, when the whol...

Possible lost msg.value

Lines of code Vulnerability details In call submit can will send value and the asset can be an ERC20!= address0, if frxETHMinter.sol contract receive this call the fouds will lost. Recommended Mitigation Steps In frxETHMinter, submit function: Check if the msg.value is zero when the asset is...

Mint legendary gobbler for free

Lines of code Vulnerability details Impact Minting a legendary gobbler does not delete getApproved, thus an owner can approve himself before minting the legendary and later transfer back these ordinary gobblers. mintLegendaryGobbler performs an imitation of burning by setting an owner to address0...

Frontrunning by malicious validator

Lines of code Vulnerability details Impact Frontrunning by malicious validator changing withdrawal credentials Proof of Concept A malicious validator can frontrun depositEther transaction for its pubKey and deposit 1 ether for different withdrawal credential, thereby setting withdrawal credit...

No check of vesting completion can break the distribution when the admin withdraws tokens

Lines of code Vulnerability details Impact VTVLVesting.sol has withdrawAdmin function to allow admins to withdraw the unallocated tokens. However, it's not controlled whether the vesting is completed. If an uncontrolled withdraw occurs in a FullPremintERC20Token contract, than it would break the...

Overflow can make a claim impossible to revoke by the admin and fully withdraw by the recipient

Lines of code Vulnerability details Impact In contract VTVLVesting.sol, the multiplication in function baseVestedAmount can overflow for big enough values of truncatedCurrentVestingDurationSecs and linearVestAmount. This means the claim could be successfully created by the admin, but could NEVER ...

The protocol doesn't support fee-on transfer ERC20 tokens

Lines of code Vulnerability details Impact The withdraw function in VTVLVesting.sol contract, doesn't handle cases where the tokenAddress is a fee-on transfer ERC20 token. There are ERC20 tokens that may make certain customisations to their ERC20 contracts. One type of these tokens is deflationar...

[NAZ-M3] Use safeTransferFrom() instead of transferFrom() for ERC721 transfers

Lines of code Vulnerability details Impact The transferFrom method is used instead of safeTransferFrom, presumably to save gas. I however argue that this isn’t recommended because: OpenZeppelin’s documentation discourages the use of transferFrom, use safeTransferFrom whenever possible. Given that...

Ambiguous situation exists for calling triggerDepeg and triggerEndEpoch functions when block.timestamp is set to epochEnd

Lines of code Vulnerability details Impact As shown by the following isDisaster modifier, which is used by the triggerDepeg function below, and the triggerEndEpoch function below, when block.timestamp is set to epochEnd, both of the triggerDepeg and triggerEndEpoch functions are allowed to be...

First depositor can break share minting

Lines of code Vulnerability details Impact Users will be unable to deposit their wished amount of tokens. Proof of Concept Similar to this ToB yearn audit, an attacker can mint a very small amount of shares and transfer a large amount of WETH to the contract, inflating the share price and making ...

splitRecipient resulting voting power tend to be overstated

Lines of code Vulnerability details When burn computes the contributor's share via getFinalContribution and contributor = splitRecipient it transfers the whole share to the splitRecipient in advance, even when not all the voting power were allocated. I.e. some contributors might not burn and the...

ArbitraryCallsProposal.sol and ListOnOpenseaProposal.sol safeguards can be bypassed by cancelling in-progress proposal allowing the majority to steal NFT

Lines of code Vulnerability details Note: PartyDAO acknowledges that "canceling an InProgress proposal mid-step can leave the governance party in a vulnerable or undesirable state because there is no cleanup logic run during a cancel" in the "Known Issues / Topics" section of the contest readme. ...

TokenDistributor: ERC777 tokensToSend hook can be exploited to drain contract

Lines of code Vulnerability details Impact TokenDistributor.createERC20Distribution can be used to create token distributions for ERC777 tokens which are backwards-compatible with ERC20. However, this introduces a reentrancy vulnerability which allows a party to get the tokens of another party. T...

NFT could be locked in settlement

Lines of code Vulnerability details Impact transferFrom is used to transfer NFT in settlement. If the receiver is a contract without appropriate way to handle the NFT, the NFT might be locked in there and non retrievable. Proof of Concept There is no check if the receiver can deal with NFT if it ...

Contracts that lock Ether

Lines of code Vulnerability details Impact When receive function, hasn't a revert all ethers send contracts will be locked forever. Proof of Concept Bob send ether to contract, funds were locked forever and Bob lost money. Tools Used manually Recommended Mitigation Steps Remove the payable...

User can generate unlimited votes through faulty transfer logic

Lines of code Vulnerability details Impact When tokens are transferred from one user to another, votes should be moved from the delegatee of the sender to the delegatee of the receiver. Instead, they are transferred from the sender to the receiver. Because the moveDelegateVotes function is...

Attacker can gain more voting power

Lines of code Vulnerability details Impact An attacker can gain more voting power at a low cost Proof of Concept When voting, voting power is taken from the snapshot at the same block as the proposal was created. The attacker can monitor mempool and borrow NFTs just in time when proposal is made...

Contract TribeRedeemer: redeemBase should has setter function

Lines of code Vulnerability details 2022-09-tribe Contract TribeRedeemer: redeemBase should has setter function tags: c4, 2022-09-tribe, high Affected code Impact Contract TribeRedeemer doesn't have setter function for redeemBase. So redeemBase can not be adjusted if it is neccesary. Contract wil...

Contract TribeRedeemer: function previewRedeem() might unable to be called forever because of devide by 0

Lines of code Vulnerability details 2022-09-tribe Contract TribeRedeemer: function previewRedeem might unable to be called forever because of devide by 0 tags: c4, 2022-09-tribe, medium Affected code Impact After redemptions, redeemBase can be 0. Then function previewRedeem always revert when be...

ATTACKER COULD PREVENT ANY OTHER USERS FROM MINTING SYNTHETIC TOKENS

Lines of code Vulnerability details An attacker can repeatedly call mint followed by burn after depositing some collateral with deposit. If this is appropriately sized and timed, it can cause the mint call to fail for another user due to the check here that is called during mint here. Every time ...

[M04] Incorrect price calculation for non-stable pairs without CANTO token

Lines of code Vulnerability details Impact A non-stable pair that doesn't have CANTO token will always have an incorrect price calculated for it. Proof of Concept The code assumes that all pairs are pairs with either NOTE or CANTO token: However, the createPair function doesn't require one of the...

Upgraded Q -> M from 167 [1662177851548]

Judge has assessed an item in Issue 167 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from 272 [1662178113276]

Judge has assessed an item in Issue 272 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

## block.timestamp used as time proxy

Lines of code Vulnerability details block.timestamp used as time proxy Summary: Risk of using block.timestamp for time should be considered. Details: block.timestamp is not an ideal proxy for time because of issues with synchronization, miner manipulation and changing block times. This kind of...

Reentrancy in repayLoan

Lines of code Vulnerability details Reentrancy in repayLoan Impact token.safeTransferFrom is called and after that state with the value is calcualted, if token can be a wrong or compromised contract this would lead to a clasic reentrancy attack that would transfer more from the balance than...

Lack of check if token is a contract

Lines of code Vulnerability details Impact TransferHelper.sol and solmate won't check if the token is a contract or not. A hacker could set traps for non existing tokens to steal future funds from users. Proof of Concept The safeTransfer functions used in the contract are wrappers around the...

Zero approval missing

Lines of code Vulnerability details Impact Frontrunning is possible where user withdraw money before setApproval refill the approval limit. This allows User to get more funds than required Proof of Concept 1. User A is approved an amount of 50 2. "custodian" decides to reduce the approval amount ...

Cushion bond markets are opened at wall price rather than current price

Lines of code Vulnerability details Impact Incorrect initial bond market price Proof of Concept uint256 initialPrice = range.wall.high.price.mulDivbondScale, oracleScale; uint256 initialPrice = invWallPrice.mulDivbondScale, oracleScale; In the above lines the initial prices are set to the wall...

permissioned modifier has a mismatch with TRSRY.withdrawReserves

Lines of code Vulnerability details Proof of Concept TRSRY.withdrawReserves is used in two polices: BondCallback and Operator. Permission is added in BondCallback, but not in Operator. And actually TRSRY.withdrawReserves does not have permissioned modifier, and there is no problem here. But...

Governance: users cannot endorse if they voted, which may cause deadlock

Lines of code Vulnerability details Impact It may cause a deadlock situation Condition: there is no proposal with enough endorsement majority depending on the endorsement threshold of votes are locked in the current proposal The votes for the current proposal are balanced between for and against ...