lastFeeRound is only updated after adding fees and updating the cumulative fee factor. So when first calling updateTranscoderWithFees() in a new round, lastFeeRound will still be set to the previous round.

Lines of code Vulnerability details Impact This could lead to incorrect fee calculations for delegators when claiming fees or pending fees. First time earnings are calculated in the new round, they will use the old cumulative fee factor rather than starting from 0 as intended. This effectively pa...

The quorum calculation in the _quorumReached() function is inconsistent and could allow abstain votes to prevent a proposal from reaching quorum even if most participating voters are in favor

Lines of code Vulnerability details Impact This allows abstain voters to effectively veto a proposal, even if most participating voters approve it. Proof of Concept The quorum numerator and denominator are inconsistent. The quorum uses totalVotes for the denominator which includes abstains. But t...

ERRORNEOUS RETURN VALUE PROVIDED BY THE UniV2LiquidityAmo.getLpTokenBalanceInWeth FUNCTION DUE TO PRECISION ERROR

Lines of code Vulnerability details Impact The UniV2LiquidityAmo.getLpTokenBalanceInWeth function is used to return the LP token balance of the contract in weth. It calls the getLpPrice function which is expected to return the LP price in 1e8 precision. getLpPrice function calls the...

The bond manager contract does not properly zero out the transcoder's cumulative rewards/fees between rounds.

Lines of code Vulnerability details Impact transcoder's cumulative rewards and fees can continue accumulating from previous rounds, instead of resetting each round. This means a transcoder could claim portion of rewards/fees that it should not be entitled to. Proof of Concept This only resets the...

on hitting ceiling, the Bonds Manager re configures to stop collecting treasure cut, but does not have inverse logic

Lines of code Vulnerability details Impact The bonds manager configures itself to stop collecting treasury reward cut, if the balance in treasury is above the configured ceiling. But, the resetting of is managed by the admin account manually. The execution of proposals is based on funds in...

UNSAFE CASTING CAN LEAD TO ERRORNEOUS utility VALUE CALCULATION

Lines of code Vulnerability details Impact The EvolvingProteus.getUtility function is used to calculate the utility value of the pool at the time of the function call. The utilitiy is calculated using a quadratic formula which is shown below: kab - 1u2 + ay + bxu + xy/k = 0 Above quadratic equati...

Lack of balance checks in the withdrawGivenOutputAmount function

Lines of code Vulnerability details Impact Lack of balance checks in the withdrawGivenOutputAmount function can lead to various unpredictable consequences due to the breach of requirements "The pool's balances of the x reserve and y reserve tokens must be greater than the MINBALANCE" and "The...

H-08 MitigationConfirmed

Lines of code Vulnerability details Original Issue H-08 - Increasing reserves breaks PrizePool accounting Details The previous implementation to increase reserves in the PrizePool contract didn't take into account the injected reserves, which caused the accounted balance in the prize pool to not ...

Upgraded Q -> 3 from #264 [1691857350267]

Judge has assessed an item in Issue 264 as 3 risk. The relevant finding follows: Let's see how it can be exploited. You can add this test to Withdraw.t.sol and run with forge test -vv --match-contract VaultWithdrawTest --match-test testWithdrawAllAssetsForHalfShares: function...

TEST PR 1093 - edited

Lines of code L1 Vulnerability details edited Assessed type call/delegatecall --- The text was updated successfully, but these errors were encountered: All reactions...

replaceMember and rotateMember redundancy

Lines of code Vulnerability details Impact The replaceMember and rotateMember functions have identical functionality which may lead to redundancy and confusion. Proof of Concept Both the replaceMember and rotateMember functions essentially perform the same action: replacing a current member...

receive function allows any user to lose funds

Lines of code Vulnerability details Impact Lending ledger receive function allows for any user to send funds and lose them forever. Proof of Concept Any user that sends funds to the Lending Ledger contract through the receive function, can't withdraw their funds meaning they would be stuck in...

The LendingLedger.sync_ledger function is susceptible to a potential reentrancy attack

Lines of code Vulnerability details Impact The primary focus is on the functions deposit/withdraw situated within the LendingMarket smart contracts, as they trigger the invocation of the LendingLedger.syncledger function. These functions carry the potential risk of containing a reentrancy issue,...

Possible DoS of Election Process

Lines of code Vulnerability details Impact Contract SecurityCouncilNomineeElectionGovernor allows contenders to participate in the election process as nominee over function addContender. The necessary condition for this process is that proposal was created before and has status...

Undelegation logic doesn't work as expected, duo to that an owner of a lock would be enforced to extend their lock time for another 5 years.

Lines of code Vulnerability details Impact Undelegation logic doesn't work as expected, duo to that an owner of a lock would be enforced to reset his lock time for another 5 years through the function increaseAmount in order to successfully undelegate. Proof of Concept There are few differences...

If user has delegated someone when locktime expires his tokens will be stuck forever.

Lines of code Vulnerability details Impact tokens will be stuck forever if user's locktime expired when his delegatee someone differant than him. Because he cannot withdraw his money also he cannot delegate himself too because his lock expired.Also he cannot use increaseamount for lockexpired and...

Absence of zero address checks for roles passed to the initialize function.

Lines of code Vulnerability details Impact The initialize function accepts various roles as part of the roles parameter SecurityCouncilManagerRoles. However, it doesn't validate whether any of these role addresses are set to the zero address address0. This omission might result in inadvertently...

Anyone can become owner of GnosisSafe(securityCouncil) contracts

Lines of code Vulnerability details Impact Member roles in SecurityCouncilManager contract can change owners of GnosisSafesecurityCouncil contracts by schedulinig a perform call to ArbitrumTimelock contract. However the contract that handles updating ownerssecurity council members with perform...

Loop condition that might prevent the function from correctly detecting range overlaps

Lines of code Vulnerability details Impact The loop iterates through each element in the stepList array and checks whether the new range overlaps with each existing range. However, the revert"Range overlap"; statement is placed inside the loop, which means that the moment any overlap is detected,...

INCORRECT ACCESS CONTROL

Lines of code https...

swapExactAmountOut() does not have deadline which allows pending transactions to be maliciously executed

Lines of code Vulnerability details Impact In LiquidationRouter.sol, swapExactAmountOut function has no deadline for the transaction when swapping. File: src/LiquidationRouter.sol function swapExactAmountOut LiquidationPair liquidationPair, address receiver, uint256 amountOut, uint256 amountInMax...

UNCHECKED TRANSFER

Lines of code Vulnerability details Impact Some tokens do not revert the transaction when transferFrom fails and returns False. Hence we must check the return value after calling the transfer or transferFrom function. Proof of Concept Check the last answer here: In short: Using...

An attacker could manipulate the _rngAuctionResult to unfairly distribute more rewards to themselves

Lines of code Vulnerability details Impact When the rewards are calculated using computeRewards, the attacker's inflated rewardFraction will be used, giving them a bigger share Proof of Concept The rngAuctionResult passed to rngComplete is stored directly into the auctionResults array without any...

USDT approval racing can lead to DoS

Lines of code Vulnerability details Impact USDT approval racing can lead to DoS Proof of Concept 2023-07-tapioca/tapioca-periph-audit/contracts/Magnetar/modules/MagnetarMarketModule.solL157 Tools Used Recommended Mitigation Steps Use safeApprove Assessed type call/delegatecall --- The text was...

Reentrancy vulnerability in SGLLendingCommon._removeCollateral

Lines of code Vulnerability details Impact This vulnerability could allow an attacker to withdraw collateral from the SGLLendingCommon contract without actually removing it. This could result in a loss of funds for the lender. Proof of Concept The SGLLendingCommon.removeCollateral function is...

_sendNative in tapiocaz::Balancer::rebalance() not sending ETH can break service

Lines of code Vulnerability details Impact function sendNative address payable oft, uint256 amount, uint16 dstChainId, uint256 slippage private if addressthis.balance amount revert ExceedsBalance; routerETH.swapETH dstChainId, oft, //refund abi.encodePackedconnectedOFTsoftdstChainId.dstOft, amoun...

Incorrect parameter for getCallerReward might return 0 reward despite insolvency

Lines of code Vulnerability details Impact The calculation of the caller reward uses an incorrect value. If the exchangeRate remains the same but a lot of interest accrues, then there will be no liquidation reward. Without a liquidation reward borrowing positions will not get liquidated and incur...

Setting debtStartPoint > 0 breaks many BigBang actions

Lines of code Vulnerability details Impact If BigBang.debtStartPoint is set to a value 0, many core features will break, e.g. deposits of collateral will be possible, but removal not, which would effectively lock collateral inside the contract. Proof of Concept BigBang.getDebtRate uses the variab...

borrowInternal() of BaseTOFTMarketModule.sol has phantom permit functions

Lines of code Vulnerability details Impact A malicious actor could steal funds from a User who has already done his first deposit. Proof of Concept Consider the case where attacker uses a token with phantom permit function as collateral, the most famous ones being WETH, BNB, HEX etc. Let’s consid...

StaticATokenLM::_claimRewardsOnBehalf: wrong update of _unclaimedRewards[onBehalfOf] if reward > totBal lead to user lose of pending rewards.

Lines of code Vulnerability details Description If for some reason the current contract reward token balance is lower than the rewards meant to be paid to onBehalf address, then this rewards can never be claimed. function claimRewardsOnBehalf address onBehalfOf, address receiver, bool forceUpdate...

Whitelisted profile creators could accidentally break migration for V1 profiles

Lines of code Vulnerability details Bug Description Profiles that exist before the V2 upgrade are migrated using the batchMigrateProfiles function, which works by minting the profile's handle and linking it to their profile: MigrationLib.solL69-L85 string memory handle =...

the unfollow contract does random unfollow process of random follow token.

Lines of code Vulnerability details Impact in the FollowNft.sol we have to unfollow function this function is supposed to do unfollow process but as you see the followTokenId variable just returns one random follow id with profile id through mapping and there is no option to select which follow n...

the getChainlinkPrice() function calling the latestRoundData without using the try/catch to avoid bad possible scenario

Lines of code Vulnerability details Impact Call to latestRoundData could potentially revert and make it impossible to query any prices. the getChainlinkPrice function should use try/catch to avoid the case of the getChainlinkPrice function revert and cause dos/block the system. Proof of Concept t...

Inconsistent encoding of arrays in MetaTxLib

Lines of code Vulnerability details Bug Description According to the EIP-712 specification, arrays are encoded by concatenating its elements and passing the result to keccak256: The array values are encoded as the keccak256 hash of the concatenated encodeData of their contents i.e. the encoding o...

In LensBaseERC721.sol#_transfer() Lack of check from==to

Lines of code Vulnerability details Impact In LensBaseERC721.soltransfer balances of from and to are stored in temporary variables and after the subtration, addition operation the results are written to storage. In the second operation since the original balance is used in the addition operation,...

tryMigrate() has onlyHub modifier but it's called from LensV2Migration

Lines of code Vulnerability details Impact In FollowNFT.sol, tryMigrate function has onlyHub modifier as other functions that are supposed to be called by LensHub such as follow and unfollow. These functions are called via delegatecall and LensHub is preserved as msg.sender. The problem is that t...

NFTBoostVault is not a proper implementation/logic contract in upgradeability system

Lines of code Vulnerability details Impact As per the natspec comments in the NFTBoostVault contract, the NFTBoostVault contract "is Simple Proxy upgradeable which is the upgradeability system used for voting vaults in Council". This implies that this contract will be used as the...

[MEDIUM] ARCDVestingVault#deposit and NFTBoostVault#_lockTokens- Unsafe transferFrom function is not properly invoked

Lines of code Vulnerability details Impact The use of transferFrom in the ARCDVestingVaultdeposit and NFTBoostVaultlockTokens functions presents a risk of erroneous token transfers. The transferFrom function doesn't perform necessary validations e.g. validate the returned bool in case of failure,...

Users with 0 votes can vote .

Lines of code Vulnerability details Impact Users with 0 votes can vote , which can lead to unwanted scenarios . Proof of Concept The function vote in CoreVoting.sol looks like this : function vote address memory votingVaults, bytes memory extraVaultData, uint256 proposalId, Ballot ballot public...

GSC will lose allowance if it tries to lower a spender's approval

Lines of code Vulnerability details Impact GSC will lose allowance if it tries to lower a spender's approval. Proof of Concept When gsc update a spender's approval, the gscAllowance will always decrease by amount: function gscApprove address token, address spender, uint256 amount external...

Voting can fail in early stage of voting in case of voter's voting power increase .

Lines of code Vulnerability details Impact Voting may fail in early stage of voting in case of voter's voting power increase . Proof of Concept In CoreVoting.sol , in terms of voting again the logic in vote function looks like this : // if a user has already voted, undo their previous vote. //...

THIS IS A TEST

Lines of code L1 Vulnerability details TESTING REFACTOR Assessed type Context --- The text was updated successfully, but these errors were encountered: All reactions...

TESTING CHANGE SEVERITY

Lines of code L1 Vulnerability details TESTING REFACTOR Assessed type Context --- The text was updated successfully, but these errors were encountered: All reactions...

Honest users could lose funds due to the current implementation of executeProposal()

Lines of code Vulnerability details Impact In the InterChainGovernance.sol contract, the executeProposal function lacks an explicit check to ensure that the msg.value provided with the function call is greater than or equal to the nativeValue specified. After an extensive discussion with the...

InterchainProposalExecutor will fail if any proposal requires value transfer, breaking core logic

Lines of code Vulnerability details Impact Proposals which are sent from a source chain using InterchainProposalSender to a destination chain to be executed using InterchainProposalExecutor are intended to support function calls that include transfers of ETH, or other native token. However, the...

InterchainTokenService.expressReceiveTokenWithData does not apply Check-Effect-Interaction mode

Lines of code Vulnerability details Impact InterchainTokenService.expressReceiveTokenWithData does not apply the Check-Effect-Interaction pattern. In some edge cases, the caller can lose funds. Proof of Concept The life cycle of sending token across chains contains 3 phases: //P1: launch on sourc...

Addresses in modifier not set correctly

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Addresses that are mintlimiter but not governance will revert thus being able not to call some functions as intended. Proof of Concept In the comment it was stated that it is either mint limiter or...

Using controlled delegatecall could in calling _deployTokenManager.tokenManagerDeploy()

Lines of code Vulnerability details Impact The use of delegatecall in this context poses a security risk. When using delegatecall, the called contract's code is executed within the context of the calling contract. This means that the deployTokenManager function is executed as if it is part of the...

Accepted proposal may be recreated at the same address with a malicious proposal if there's a self destruct function in the accepted proposal

Lines of code Vulnerability details Impact A malicious proposal can take over the contract address of the accepted proposal through self-destruct Proof of Concept This issue is regarding the Tornado cash hack, whereby the attacker deploys different contracts at the same address. If the proposal...

MultisigBase.sol : Unsafe onlySigners modifier

Lines of code Vulnerability details Impact The multi sig based implementation will not serve its purpose. Proposals can be executed even by a single signer. Proof of Concept Contract has the MultisigBase implementation which will be used as a custom multisignature wallet where transactions must b...