Wrong logic in function _removeFeeder() cause feeders unable to be removed.

Lines of code Vulnerability details Impact In NFTFloorPrice, there are multiple components to allow easy adding/removing keepers address public feeders - List of all keepers' address mappingaddress = FeederPositionindex, register private feederPositionMap When adding new keeper, new keeper addres...

saleReceiver and feeReceiver can steal refunds after sale has ended

Lines of code Vulnerability details First, lets go over how a buy happens. A buyer can buy NFTs at a higher price and then once the auction ends they can use refund to return the over payments. The effect is that they bought the NFTs at the lowest price Lowest Price Dutch Auction. Now, let's move...

finalise() lacks authenticate calls to this method as anyone can access it.

Lines of code Vulnerability details Impact Unprotected call to a function sending Ether to an arbitrary address. This can be exploited by attackers . Proof of Concept function finalize public Sale memory temp = sale; requireblock.number = temp.endTime, "TOO SOON";...

call() should be used instead of transfer() on an address payable

Lines of code Vulnerability details Impact call should be used instead of transfer on an address payable Proof of Concept The use of the deprecated transfer function for an address will inevitably make the transaction fail when: 1. The claimer smart contract does not implement a payable function...

NFTs mintable after Auction deadline expires

Lines of code Vulnerability details Impact The buy function on the LPDA.sol contract is not validating if the auction is still running, allowing a purchase to be made after the stipulated time. The endtime variable used to store the end date of the auction is not used at any point to validate...

MarketplaceLogic.sol doesn't support ERC20 Tokens with fee on transfer

Lines of code Vulnerability details MarketplaceLogic.sol doesn't support ERC20 Tokens with fee on transfer Summary There are ERC20 tokens with transfer at fees. For checking if the transferred amount is the same as expected, code already compares balanceOf before and balanceOf after transfer...

Bad debt will likely incur when multiple NFTs are liquidated.

Lines of code Vulnerability details Description getUserBalanceForERC721 in GenericLogic gets the value of a user's specific ERC721 xToken. It is later used for determining the account's health factor. In case isAtomicPrice is false such as in ape NTokens, price is calculated using: uint256...

User can pass auction recovery health check easily with flashloan

Lines of code Vulnerability details Description ParaSpace features an auction mechanism to liquidate user's NFT holdings and receive fair value. User has the option, before liquidation actually happens but after auction started, to top up their account to above recovery factor 1.5 instead of 1 an...

[ZZ-004] During the deprecation period where both .eth registrar controllers are active, a crafted hack can be launched and cause the same malicious consequences of [ZZ-001] even if [ZZ-001] is properly fixed

Severity: High Status: Has not been reported Description, Specifically, according to the documentation, there will be a deprecation period that two types of .eth registrar controllers are active. Names can be registered as normal using the current .eth registrar controller. However, the new .eth...

First depositor can inflate share price

Lines of code Vulnerability details Impact A well-known vulnerability for ERC4626 vaults is the inflation of the share price on the first deposit. Because AutoPxGlp and AutoPxGmx use the balance of the underlying asset for totalAssets and do not have an initial minimum deposit amount, they are al...

AutoPxGlp and AutoPxGmx are not compliant with ERC4626 standard

Lines of code Vulnerability details Proof of Concept In both contracts, the previewWithdraw function has the same body // Calculate shares based on the specified assets' proportion of the pool uint256 shares = convertToSharesassets; // Save 1 SLOAD uint256 totalSupply = totalSupply; // Factor in...

Steal deposit fund in ERC4626 vault by exchange rate manipulation

Lines of code Vulnerability details Impact Although the PirexERC4626 and AutoPxGlp contract check for 0 shares, the rounding down error can still be used to steal new user deposit. Part of the new deposit could be stolen. The attacker may monitor the pool activities to catch the steal...

[H-01] owner not set in Pool.sol

Lines of code Vulnerability details The pool.sol contract here is an UUPSUpgradeable contract. But there is no initialize function where Ownableinit is called , due to which owner is 0x0. It would be impossible to call authorizeUpgrade or change ownership of the contract. POC Adding the following...

Counterparty can cancel subsequent orders within ETH or token transfer callback.

Lines of code Vulnerability details Impact The scenario is when a caller uses bulkExecute to request a sequence of executions on the Exchange. The caller will generally expect that all orders valid prior to calling bulkExecute will be valid during the execution of bulkExecute. However, a...

Broken Upgradable Logic in Pool.sol

Lines of code Vulnerability details Impact The Pool smart contract allows a user to predeposit ETH so that it can be used when a seller takes their bid. It uses an ERC1967 proxy pattern and only the exchange contract is permitted to make transfers. The smart contract inherits the...

Upgraded Q -> M from #334 [1668467418003]

Judge has assessed an item in Issue 334 as M risk. The relevant finding follows: 2. Rug vectors by the owner A malicious owner can call setLBPairImplementation, setFeeRecipient, setFlashLoanFee , setFeesParameters and forceDecay to advantage himself at expenses of the users...

EVERY TIME ONCE _execute FUNCTION COMPLETED NEED TO SET isOpen TO 0. OTHERWISE WE CAN CALL EXECUTE FUNCTIONS MULTIMPLE TIMES.

Lines of code Vulnerability details Impact IN THIS WAY WE CAN CALL AND EXECUTE FUNCTIONS MULTIPLE TIMES . EVERY TIME BEFORE CALL EXECUTE NEED TO CALL INITIALIZE FUNCTIONS. Proof of Concept function executeInput calldata sell, Input calldata buy public payable reentrancyGuard internalCall...

_returnDust does not revert ether transfer failure

Lines of code Vulnerability details Impact In function returnDust the return value of call is not checked for success. If a user had sent excess ether or if an order in a bulk order had failed, and if the call fails ether will remain in the contract. Users who execute orders later will be able to...

Upgraded Q -> M from #107 [1668211909800]

Judge has assessed an item in Issue 107 as M risk. The relevant finding follows: L-01 WardenPledge inherits Ownable instead of Owner The contract imports Owner.sol but inherits Ownable - should both import and inherit Owner --- The text was updated successfully, but these errors were encountered:...

Seller can steal all the bid fund by repeatedly calling finalize()

Lines of code Vulnerability details Impact Bidders' fund will be stolen by malicious seller, they can not get refund. Proof of Concept In finalize, FinalizeData memory data is local, which means in each call, data is re-initialized. By calling finalize multiple times, a malicious seller can get t...

MED: isOwner / onlyOwner checks can be bypassed by attacker in ERC721/ERC20 implementations

Lines of code Vulnerability details Description ERC20H and ERC721H are base contracts for NFTs / coins to inherit from. They supply the modifier onlyOwner and function isOwner which are used in the implementations for access control. However, there are several functions which when using these the...

Royalties cannot be collected for many ERC20 tokens (USDT, BNB and many more) due to use of transfer function.

Lines of code Vulnerability details Description ERC20 royalties are paid using payoutTokens and payoutToken functions in PA1D.sol. Unfortunately these functions use ERC20's transfer instead of implementing safeTransfer: for uint256 i = 0; i length; i++ sending = bpsi balance / 10000;...

Missing support of non-standart ERC20

Lines of code Vulnerability details Vulnerability details Description In functions of PA1D and HolographOperator contracts there is logic relying on the fact that tokens implemented ERC20 standard especially, that transfer and transferFrom functions of the tokens returns bool result. But in...

_payoutEth() calculates balance with an offset, always leaving dust ETH in the contract

Lines of code Vulnerability details Payout recipients can call getEthPayout to transfer the ETH balance of the contract to all payout recipients. This function makes an internal call to payoutEth, which sends the payment to the recipients based on their associated bp The issue is that the balance...

setRoyalties can lead to royalties set to greater than 100%, breaking royalty functionality

Lines of code Vulnerability details enforcer/PA1D can be used by NFT smart contracts to provide royalty info. The owner can call setRoyalties to set the royalties for a specific token id, or the default royalty of the collection. Marketplaces implementing EIP-2981 can then use royaltyInfo to get...

NFT not minted when contributed via a supported payment terminal

Lines of code Vulnerability details Impact A contributor won't get an NFT they're eligible for if the payment is made through a payment terminal that's supported by the project but not by the NFT delegate. Proof of Concept A Juicebox project can use multiple payment terminals to receive...

Wrong calculation in LBRouter._getAmountsIn.

Lines of code Vulnerability details Impact It calculates the amountsIn wrongly here and the function returns the wrong result. Proof of Concept Currently, getAmountsIn calculates the amountsIn like below. amountsIni - 1 = reserveIn amountOut 1000 / reserveOut - amountOut 997 + 1; As we can see...

Upgraded Q -> M from 796 [1666363133014]

Judge has assessed an item in Issue 796 as Medium risk. The relevant finding follows: L‑01 Use of transferFrom rather than safeTransferFrom for NFTs in will lead to the loss of NFTs The EIP-721 standard says the following about transferFrom: /// @notice Transfer ownership of an NFT -- THE CALLER ...

Upgraded Q -> M from 873 [1666362235337]

Judge has assessed an item in Issue 873 as Medium risk. The relevant finding follows: Avoid payableaddress.transfer GolomTraderpayEther uses payableaddress.transfer to send native ETH. It's considered a best practice to avoid this pattern for ETH transfers, since it forwards a fixed gas stipend...

The beneficiary could be the zero address

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. There is no zero address check for the beneficiary ,therefore it is possible the beneficiary is zero and we lose all the reserves Proof of Concept Provide direct links to all referenced code in GitHub...

Upgraded Q -> M from 220 [1665830289014]

Judge has assessed an item in Issue 220 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Permanent lockup of tokens without recovery possible

Lines of code Vulnerability details Impact The callhook for whitelisted contracts adds an additional layer of complexity that can have multiple points of failure. If the execution of L2GraphTokenGateway.finalizeInboundTransfer fails indefinitely, there is currently no way to recover the...

If L1GraphTokenGateway's outboundTransfer is called by a contract, the entire msg.value is blackholed, whether the ticket got redeemed or not.

Lines of code Vulnerability details The outboundTransfer function in L1GraphTokenGateway is used to transfer user's Graph tokens to L2. To do that it eventually calls the standard Arbitrum Inbox's createRetryableTicket. The issue is that it passes caller's address in the submissionRefundAddress a...

Ignores return value from L1GraphTokenGateway.outboundTransfer

Lines of code Vulnerability details Impact Not tracking values returned by token transfer from. So from was getted from parseOutboundData, and if encoded data is wrong, this can return not expected from address. Then from will passed into transferFrom and it not approve for escrow or allowance is...

Use safeTransferFrom instead of transferFrom()

Lines of code Vulnerability details Impact Although ERC20 standard suggests that a transfer should return true on success, there are tokens that doesn't comply with this. Therefore, the transferFrom call might cause silent failures and will affect the token accounting in this contract. Proof of...

BlurExchange Contract May Not Be Upgradeable

Lines of code Vulnerability details Vulnerability Details The BlurExchange is designed to be an implementation contract supporting an upgradeable feature. However, we found that some contracts define state variables without allocating the reserved storage slots gap which may impede the BlurExchan...

Passing chain id from outside

Lines of code Vulnerability details Impact Passing chain id from outside. Incorrect chain id can be passed. Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Use assembly to obtain current chain id. --- The text was updated successfully, but these errors were encountered:...

USE OF SOLIDITY VERSION 0.8.14 WHICH HAS KNOWN ISSUES APPLICABLE TO Blur Exchange

Lines of code Vulnerability details Vulnerability details Vulnerability related to ‘Optimizer Bug Regarding Memory Side Effects of Inline Assembly’ ref : Blur Exchange inherits solidity contracts from openzeppelin and these uses inline assembly, and optimization is enabled while compiling...

Payable with no way of taking funds out / using msg.value can lock funds

Lines of code Vulnerability details Impact External execute function may lock funds --- The text was updated successfully, but these errors were encountered: All reactions...

execute does not work for ERC1155 tokens orders where amount > 1

Lines of code Vulnerability details Impact StandardPolicyERC1155 functions canMatchMakerBid and canMatchMakerBid always return amount == 1, regardless of the function arguments. This means that calling execute on an agreed order of ERC1155 token with an amount 1 will always transfer amount == 1 o...

Underhanded meaning of expirationTime == 0

Lines of code Vulnerability details Impact The pwner of BlurExchange can reject the rigor of code and fulfill the ambiguity of human expression, forcing a reinterpretation of expirationTime == 0 to "no expiration time at all". Unexpirable orders in the vicissitudes of the crypto markets do not...

Unchecked transfer/transferFrom return can lead to protocol lose of funds

Lines of code Vulnerability details Impact It is good to add a require statement that checks the return value of token transfers or to use something like OpenZeppelin's safeTransfer/safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so will cause silen...

It is possible that, after swapping, extra input token amount is transferred from user to pool but pool does not give user output token amount that corresponds to the extra input token amount

Lines of code Vulnerability details Impact When calling the swap function below, the following swapCallback function is further called for calling the algebraSwapCallback function in the callee contract, which is msg.sender; such contract could be implemented by a third party especially for...

Lack of check for contract existance can cause loss of funds during transfers

Lines of code Vulnerability details Impact The current transfers will not check if the to address is for an existing token contract. This can cause loss of funds if an user attempts to make a swap for a tokens added to a pool and destructed later. Proof of Concept TokenA gets added to a pool The...

Anyone who is malicious can front-run initialize transaction to set pool's initial price to a value that deviates quite a lot from market price, which discourages users from using the pool and makes the pool useless

Lines of code Vulnerability details Impact Calling the following initialize function sets the initial price for the pool. Setting the initial price to be similar to the current market price would encourage users to use the pool. Yet, the initialize transaction is vulnerable to front-running. For...

The invalid output amount is not checked while swapping

Lines of code Vulnerability details Impact The invalid output amount is not checked while swapping. If calculateSwapAndLock returns a positive amount for both amount0 and amount1, the user may need to pay both input and output tokens to the pool resulting in the loss of funds. Proof of Concept...

Upgraded Q -> M from 182 [1664281111530]

Judge has assessed an item in Issue 182 as Medium risk. The relevant finding follows: L00: Usage of transfer to send eth The transfer function has a fixed gas stipend of 2300. If a contract as well as EOA can call the function, it is advised to use call function instead of transfer. Here are...

Users can regain gobblers they use to mint Legendary Gobbler with.

Lines of code Vulnerability details Impact Users can mint legendary gobblers without actually burning their gobblers by using the GobblersERC721.approve function to approve themselves before minting their legendary gobbler the burn mechanism, doesn't delete the getApproved approved entry for that...

Check-Effect-Interact Violations and possible Reentrancy

Lines of code Vulnerability details Impact Some contracts functions make external calls and do not follow the CEI pattern thereby allowing the function to possibly be re-entered. Proof of Concept 1. ArtGobblers.mintFromGoo - , numMintedFromGoo and currentNonLegendaryId state variables updated aft...

Some real-world NFT tokens may support both ERC721 and ERC1155 standards, which may break gobble ()

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...