Unbounded iteration in NFTXEligiblityManager.distribute over _feeReceivers

Handle @cmichelio Vulnerability details Vulnerability Details NFTXEligiblityManager.distribute iterates over all feeReceivers. Impact If the number of feeReceivers gets too big, the transaction's gas cost could exceed the block gas limit and make it impossible to call distribute at all. Recommend...

Randomnesss can be manipulated

Handle adelamo Vulnerability details Here you have more info: --- The text was updated successfully, but these errors were encountered: All reactions...

Rewards cannot be withdrawn

Email address [email protected] Handle @cmichelio Eth address 0x6823636c2462cfdcD8d33fE53fBCD0EdbE2752ad Vulnerability details The rewards for a recipient in IncentiveDistribution.sol are stored in the storage mapping indexed by recipient accruedRewardrecipient and the recipient is the actual margi...

testing

Email address [email protected] Handle adamavenir Eth address 23423423r4 Vulnerability details 1 Impact 2 Proof of concept 3 Tools used 4 Recommended mitigation steps 5 --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> 2 from #37 [1703589922038]

Judge has assessed an item in Issue 37 as 2 risk. The relevant finding follows: L-02 openPosition maybe underflow in openPosition - Base.swap function openPosition DataStruct.OpenPositionParams calldata params public override nonReentrant returns uint96 lienId, uint256 collateralTo...

When the returnNative parameter is set to true in the _params provided to MoneyMarketHook.execute, it is not handled properly and could disrupt user expectations

Lines of code Vulnerability details Impact When param.returnNative is set to true while calling MoneyMarketHook.execute, users expect the returned token from the withdraw operation to be in native form and sent to the caller. However, in the current implementation, this is not considered and coul...

Tighten Admin Access Control

Lines of code Vulnerability details Admin functions do not use a custom admin role and rely only on owner access control. Recommendation: Implement a custom admin role. // Custom admin role instead of owner enum Role ADMIN // Restrict drop function function dropTopVotedPiece external...

LendingPool interest should not accrue when pool's repay is paused

Lines of code Vulnerability details Impact When the canRepay status of pools inside InitCore is paused, users are not allowed to repay their positions when borrowing from the paused pool. However, interests continue to accrue during this pause period, exposing users to potential liquidation risk...

Two items having same number of votes above the quorum can lead to invariant violation and unfairness towards either of the item

Lines of code Vulnerability details Impact When an item is dropped or extracted from the maxHeap tree, it is directly done so from the item at the root of the tree i.e. index 0. Although this is expected, if one of the child itemIds have number of votes equal to that of the root node, this would ...

Validate Creators Array

Lines of code Vulnerability details Potential Risk: The validateCreatorsArray function in the CreatorUtils contract performs input validation for the creatorArray parameter, which is an array of CreatorBps structs. While the function checks the individual elements of the array for valid addresses...

LP owner cannot control slippage while managing their position

Lines of code Vulnerability details Summary The owner of the LP cannot specify the slippage parameters while interacting with this position in increaseLiquidity and decreaseLiquidity. Impact Liquidity interaction with Uniswap is protected by minimum amount parameters that control the slippage of...

Votes delegated to the zero address will be stuck forever and user can no longer delegate votes

Lines of code Vulnerability details Bug Description VotesUpgradeable automatically delegates a user's votes to themselves if a delegatee is not set. VotesUpgradeable.solL165-168 function delegatesaddress account public view virtual returns address VotesStorage storage $ = getVotesStorage; return...

In case if wLP will be blacklisted then user will not be able to withdraw it

Lines of code Vulnerability details Proof of Concept When users deposit wLP tokens as collateral, then they are checked to be whitelisted. Later, it's possible that for some reason wLP token will be backlisted by governor. And once it's done, then users, who already used that wLP tokens as...

addRewardToken() does note remove old entries before adding new ones

Lines of code 455, 280, 378, 411 Vulnerability details Each time addRewardToken is called, new entries are added to the array, but doing so does not remove any old entries. By calling the function multiple times, an attacker can can increase their voting power indefinitely, without having to...

Position cannot be liquidated if the borrower is blocklisted

Lines of code Vulnerability details Impact position cannot be liquidated if the borrower is blocklisted Proof of Concept When the position is closed, the function closePosition is called // execute actual position closing closePositionparams, cache, lien, msg.sender; in this case, the msg.sender ...

Should count pending harvest reward and already harvested reward as collateral credit if the collateral is WLP

Lines of code Vulnerability details Impact Should count pending harvest reward and already harvested reward as collateral credit if the collateral is WLP Proof of Concept User can use WLP as collateral, even use WLP purely as collateral to borrow fund from lending pool the collateral worth of WLP...

addRewardToken() does note remove old entries before adding new ones

Lines of code 455, 280, 378, 411 Vulnerability details Each time addRewardToken is called, new entries are added to the array, but doing so does not remove any old entries. By calling the function multiple times, an attacker can can increase their voting power indefinitely, without having to...

Unsafe use of approve() with IERC20

Lines of code 321, 215, 184, 450, 761, 217, 157, 234, 339, 386https://github.com/Tapioca-DAO/t...

imbalanced or invalid liquidity additions/removals could happen

Lines of code Vulnerability details Impact Potential for loss of funds or manipulation of the pool prices. Specifically: • By allowing deposit from only one of the xToken or yToken, it enables manipulating the price ratio between the tokens in the pool. This could benefit one token over the other...

Lack of Validation and Potential Overflow in _fetchInteractionId Function

Lines of code Vulnerability details Impact The lack of validation on interactionType could allow invalid values, potentially leading to unexpected interaction IDs. Additionally, if interactionType exceeds 8 bits, it could cause an overflow issue, potentially altering the token address within the...

Wrapping ether with Ocean.doMultipleInteractions() reverts

Lines of code Vulnerability details Summary Wrapping ether with doMultipleInteractions reverts. This is the case if one or more of the interactions is handling ether. If we look at the internal helper function, doMultipleInteractions, it includes the following: if msg.value != 0...

Potential Gas and Overflow Issues with Decimal Shift Left in _convertDecimals Function

Lines of code Vulnerability details Impact The exponentiation operation in the decimal shift left scenario can lead to high gas consumption and potential integer overflow. The gas cost and risk of overflow increase with the value of the exponent, which could make the function expensive or even...

Limited functionality due to Primitive's balance being decreased before it is called

Lines of code Vulnerability details Impact In the current implementation, the balance of a primitive is decreased burned before it is called. This requires the primitive to hold outputAmount of outputToken before a transaction, which severely restricts the functionality it can provide and has no...

Array is push()ed but not pop()ed, and is iterated over

Lines of code 96, 485, 485, 485, 485, 485, 485, 485, 485, 485, 485https://github.com/Tapioca-DAO/ta...

Upgraded Q -> 2 from #776 [1701456793936]

Judge has assessed an item in Issue 776 as 2 risk. The relevant finding follows: Low-01 No minimum AmountrsETH receive parameter absent in depositAsset Here we can see that User deposit asset via depositAsset which take asset address and asset depositAmount as parameter Then rsethAmountMinted...

Unsafe use of approve() with IERC20

Lines of code 321, 215, 184, 450, 761, 217, 157, 234, 339, 386https://github.com/Tapioca-DAO/t...

Cannot withdraw 1:1

Lines of code Vulnerability details function testX public uint256 mintAmount = 10e18; NOTE.mintalice, mintAmount; vm.startPrankalice; NOTE.approveaddressasdToken, mintAmount; asdToken.mintmintAmount; uint256 newExchangeRate = 1.1e28; cNOTE.setExchangeRatenewExchangeRate; vm.startPrankowner;...

Holder cannot claim fee

Lines of code Vulnerability details Impact Assume a user buys some shares and mints it to an NFT and sends the shares to a cold wallet for safety. The following happens: A user buys 10 shares using buy is called, the rewardsLastClaimedValue is updated to the latest holder rewards, the...

There is potential underflow and overflow issues in arithmetic operations in the _getRewardsSinceLastClaim function

Lines of code Vulnerability details Impact There are potential underflow and overflow issues in arithmetic operations. Not being able to verify that subtracting lastClaimedValue from shareDataid.shareHolderRewardsPerTokenScaled would result in a negative value. This could lead to affecting the...

Creator can earn holder fee

Lines of code Vulnerability details Impact Creator can earn creator and holder as well. Proof of Concept In market.sol contract there is a buy function which cannot be used by creator of share. requireshareDataid.creator != msg.sender, "Creator cannot buy"; However, it's still possible for creato...

asD.sol::mint & asDFactory.sol::create allows an attacker to mint legitimate aSD with counterfeit underlying $NOTE

Lines of code Vulnerability details Impact When creating an aSD token using create from the asDFactory.sol, there's the cNote address reference to specify and set. A malicious user can deploy a counterfeit NOTE underlying token that isn't legit or backed by anything and set/reference it as...

Precision loss in getRSETHPrice

Lines of code Vulnerability details Impact Precision loss and return zero price by Oracle Proof of Concept Since the value of staked ether increases, the price of RSETH goes above ETH price and leads to a precision loss in the getRSETHPrice function of the oracle, and RSETH price becomes zero...

Users could game oracle price deviation

Lines of code Vulnerability details Summary Prices returned from Chainlink oracles have different conditions to update the reported values, which can be abused by Impact Prices for the different LST assets supported in the Kelp protocol are obtained from a Chainlink oracle. The data feeds for eac...

No function to distribute secondary sales royalties split.

Lines of code Vulnerability details Impact The minter contract currently does not have a way to reliably share the secondary sales revenue for the proposed addresses and splits. Proof of Concept Contract : NextGenMinterContract The minter contract uses collectionArtistSecondaryAddresses and...

Cross-Contract Reentrancy can occur during burnToMint

Lines of code Vulnerability details Impact Cross Contract re-entrancy can occur due to not following CEI Proof of Concept 1. Attacker can call burnToMint, with any of the tokenId he owns! 2. This calls the burnToMint in GenCore, which mints the the new token from the to be minted collection...

High possibility of DOS

Lines of code Vulnerability details Impact In the claimAuction function there is a high possibility of DOS where the auction winner is unable to claim the NFT due to high gas cost or not enough gas, this is due to the functions having three loops on same array of all bids, they are in the...

Re-enterancy in AuctionDemo contract

Lines of code Vulnerability details Impact claimAuction function of AuctionDemo contract transfers the token to highest bidder winner and the bid amount is transferred to the owner. Moreover, refund is sent to all remaining participants non-winners of the auction via call function. However, if a...

The absence of sanity checks in the MinterContract#mintAndAuction() function can lead to avoidable error scenarios.

Lines of code Vulnerability details Impact The setCollectionCosts function within the MinterContract is utilized to establish the collection costs and sales model for an upcoming collection sale. As outlined in the documentation, the expectation is that one token can be minted and auctioned durin...

Potential DDOS

Lines of code Vulnerability details Impact With three loops, and an On+ 0n2 complexity this could cause DOS with users not being able to call this functions Proof of Concept Tools Used Recommended Mitigation Steps Assessed type DoS --- The text was updated successfully, but these errors were...

In parties with more than one host, a single host can bypass the execution delay of a proposal by transferring his host status to other addresses of his.

Lines of code Vulnerability details The Vulnerability After a proposal has gathered enough votes to pass, it waits through a period defined in the governance values named executionDelay. That executionDelay period is bypassed and the proposal can be executed immediately if ALL hosts of the party...

No token whitelist leaves rageQuit() vulnerable to malicious ERC20 token contracts

Lines of code Vulnerability details A malicious actor can exploit the PartyGovernanceNFT.sol::rageQuit function by specifying a malicious IERC20 contract in the withdrawTokens array. The malicious contract could "donate" tokens to the proxy contract to pass the balance check here and when the...

interest is still accuring when the market is paused, force user to incur debts

Lines of code Vulnerability details Impact interest is still accuring when the market is paused, force user to incur debts Proof of Concept when the function accure is called the interest is accured after the interest rate is calculated uint256 interestRate = IIRMirm.getInterestRateaddressthis,...

Upgraded Q -> 2 from #300 [1699029650174]

Judge has assessed an item in Issue 300 as 2 risk. The relevant finding follows: L-01 transferSAFEOwnership does not reset users allowed to modify a safe on behalf of an owner transferSAFEOwnership is not deleting potential allowed users in safeCan upon transferring a safe ownership. This could...

Temporary DOS attack on users minting and redeeming big amount using EthenaMinting.sol

Lines of code Vulnerability details Impact The users redeeming and minting using EthenaMinting.sol with a large amount can be vulnerable to DOS attack. Proof of Concept There is a limit on the max amount to redeem and mint in a block. This can be crucial to the users that are minting or redeeming...

Staking functionality temporary blocking due to lack of address zero check

Lines of code Vulnerability details Impact Though lack of zero check issue for the addToBlacklist function is already at the automated findings output, I suppose it is necessary to show the importance of this check here. In case of accidental or malicious the BLACKLISTMANAGERROLE behavior the...

There is no check for collateral token in mint matches same in withdraw

Lines of code Vulnerability details Impact While we understand that usde is the base token here, we see that on minting used token you would need to transfer some tokens to the contract and get some used minted to you and on redemption get usde burnt to get a token sent back to you. The implicati...

InterestRate can be changed during close market.

Lines of code Vulnerability details Summary After closing market, the borrower can set the interest rate. Impact Breaking calculations, loss of funds. Vulnerability Details After borrower closed the market, he can set interest rate, this means remaining totalSupply still earn interest while it...

Lack of access control on overrideSanction(), any user can override sanctioned address

Lines of code Vulnerability details Impact Without proper access control, any address can call the overrideSanction function and override the sanction status of an account. This can potentially be exploited by malicious actors to bypass sanctions and carry out unauthorized actions, putting the...

A borrower cannot redeploy a controller if their previous controller was removed

Lines of code Vulnerability details Impact A controller can be removed after it was initially deployed in cases where it was created with wrong parameters. However, in the case that a borrower's controller is removed they would be unable to redeploy another controller constraining them to use the...

Usury from simple mistake

Lines of code Vulnerability details Impact A borrower making a simple mistake might be forced to pay an extortionate interest rate for en extended period of time. Severity rating I was hovering between Medium and High on this one. Medium because it is based on a user mistake. On the other hand, t...