10190 matches found
Upgraded Q -> 2 from #596 [1677228840417]
Judge has assessed an item in Issue 596 as 2 risk. The relevant finding follows: withdraw and redeem function withdraw IERC4626 vault, address to, uint256 amount, uint256 maxSharesOut public payable virtual override returns uint256 sharesOut ERC20addressvault.safeApproveaddressvault, amount; if...
Multiple KBCTokens can be minted fir single KUMABondToken id.
Lines of code Vulnerability details Impact The KUMASwap.buyBond mints KBCTokens clone token for every KUMABondToken whose bondFaceValue is greater than realizedBondValue. function buyBonduint256 tokenId external override whenNotPaused whenNotDeprecated IKUMAAddressProvider KUMAAddressProvider =...
KUMAFeeCollector.changePayees() executes incorrectly when newPayees contains duplicate items
Lines of code Vulnerability details Impact When calling KUMAFeeCollector.changePayees with duplicate payees in newPayees, the call is not reverted and the result state will be incorrect. Proof of Concept Contract KUMAFeeCollector does not support duplicate payees. The transaction will revert when...
Average APRs might be calculated wrongly after calling populateFromPreviousThrottle().
Lines of code Vulnerability details Impact Average APRs might be calculated wrongly after calling populateFromPreviousThrottle and targetAPR might be changed unexpectedly. Proof of Concept The epoch state struct contains cumulativeCashflowApr element and cashflowAverageApr is used to adjust...
Value of totalProfit might be wrong because of wrong logic in function sellMalt()
Lines of code Vulnerability details Impact Contract SwingTraderManager has a totalProfit variable. It keeps track of total profit swing traders maded during sellMalt. However, the logic for accounting it is wrong so it will not have the correct value. As the results, it can affect other contracts...
StabilizerNode.stabilize uses stale GlobalImpliedCollateralService data, which will make stabilize incorrect
Lines of code Vulnerability details Impact In StabilizerNode.stabilize, impliedCollateralService.syncGlobalCollateral is called only at the end of the function to synchronize the GlobalImpliedCollateralService data. if !shouldAdjustSupplyexchangeRate, stabilizeToPeg lastStabilize = block.timestam...
Mitigation of M-05: Issue not fully mitigated
Lines of code Vulnerability details Original issue: M-05: early user can call issue and then melt to increase basketsNeeded to supply ratio to its maximum value and then melt won't work and contract contract features like issue won't work Not mitigated - attacker can still manipulate the...
Incompatibilty of BackingManager with some tokens.
Lines of code Vulnerability details Impact The BackingManager contains a grantRTokenAllowance function which is used to grant token allowances to the RToken contract. function grantRTokenAllowanceIERC20 erc20 external notFrozen requireassetRegistry.isRegisterederc20, "erc20 unregistered"; // ==...
MaltRepository._revokeRole may not work correctly
Lines of code Vulnerability details Impact MaltRepository inherits from AccessControl and adds validation of validRoles to the hasRole function, which means that even if super.hasRolerole, account == true, if validRolesrole == false hasRole will return false, which will cause revokeRole to not wo...
Upgraded Q -> 2 from #154 [1676532286167]
Judge has assessed an item in Issue 154 as 2 risk. The relevant finding follows: Quest.claim can risk gas exhaustion on large receipt claims due to multiple mandatory loops function claim public virtual onlyQuestActive if isPaused revert QuestPaused; uint256 memory tokens =...
Attacker can cause loss to rToken holders and stakers by running BackingManager._manageTokens before rewards are claimed
Lines of code Vulnerability details Impact The assets that back the rTokens are held by the BackingManager and can earn rewards. The rewards can be claimed via the TradingP1.claimRewards and TradingP1.claimRewardsSingle function. The BackingManager inherits from TradingP1 and therefore the above...
sellMalt has a calculation error that can lead to excessive profits
Lines of code Vulnerability details Impact SwingTraderManager.sellMalt will call SwingTrader.sellMalt to sell the Malt purchased earlier and give the profit to profitDistributor to distribute. uint256 basis, = costBasis; if maxAmount totalMaltBalance maxAmount = totalMaltBalance;...
recreateMinipool may not be called
Lines of code Vulnerability details Impact recreateMinipool may not be called Proof of Concept To resolve M-09, the fix is that: function recordStakingEndThenMaybeCycle address nodeID, uint256 endTime, uint256 avaxTotalRewardAmt external payable whenNotPaused int256 minipoolIndex =...
Upgraded Q -> 2 from #362 [1676219107265]
Judge has assessed an item in Issue 362 as 2 risk. The relevant finding follows: N‑01 Upgradeable contract is missing a gap50 storage variable to allow for new storage variables in later versions --- The text was updated successfully, but these errors were encountered: All reactions...
Unsafe token transfer in MultiRewardStaking and VaultController contracts
Lines of code Vulnerability details Impact The vulnerability in the MultiRewardStaking and VaultController contracts lies in the usage of the transfer and transferFrom functions, which does not provide the safety checks for the transfer of tokens, especially since the reward token can have...
MultiRewardEscrow.claimRewards() can break for rebasing tokens
Lines of code Vulnerability details Rebasing tokens make balanceOf modifications arbitrarily e.g: Aave share tokens. If such token is used in an escrow, the balance could become insufficient at the time of claiming rewards, making it impossible to claim rewards for that escrow. Impact Medium Proo...
Missing owner check in function addTemplate in DeploymentController
Lines of code Vulnerability details Impact Attacker can add malicous Vaults/Adatpors/Strategies template to TemplateRegistry. Attack can frontrun operator's transaction with the same templateCategory and templateId, but with a malicious Vault/Adatpor/Strategy template. If the operator does not...
managementFee is unfair and can be used to steal stakers deposits
Lines of code Vulnerability details Description managementFee is a fee that is taken on TVL and calculated per year: File: Vault.sol 429: function accruedManagementFee public view returns uint256 430: uint256 managementFee = fees.management; 431: return 432: managementFee 0 433: ?...
Overflow tokens
Lines of code Vulnerability details Impact If admin will add more than 255 tokens in rewardToken, there would'nt any way to withdraw tokens or claim rewards Proof of Concept for example: all users deposit their money.After some time admin's add more tokensa, length of array with Token grow's to...
Inflation attacks with virtual shares and assets
Lines of code Vulnerability details Impact When the BaseAdapter is empty. Someone can frontrun a user to steal his funds by an inflation attack. Senario Lets say Alice wants to deposit 1 token with decimal 18, so 1e18 units to the vault calling deposit. This is how the attack would unfold. The...
Upgraded Q -> 3 from #648 [1675725284542]
Judge has assessed an item in Issue 648 as 3 risk. The relevant finding follows: 1. Incorrect Minter Address Validation in Mint Function Link : Summary: The mint function in the RabbitHoleReceipt contract does not correctly check the msg.sender address for minter permissions. The onlyMinter...
Upgraded Q -> 2 from #648 [1675725337760]
Judge has assessed an item in Issue 648 as 2 risk. The relevant finding follows: 2. Unbounded Array Vulnerability in Claim Function Link : Summary: The claim function in the Quest contract has an unbounded array vulnerability that could lead to an Out-of-Gas OOG error and make the contract...
int128 cast underflow in _receiveDripsResult()
Lines of code Vulnerability details Impact In receiveDripsResult, the type cast of uint128 could underflow, and result in wrong receivedAmt. The impacts could be: wrong amount being transferred to users and drain the protocol fund inaccurate transfer amount, some users lose fund and some receive...
Incorrect shift in assembly
Lines of code Vulnerability details Impact Shift operators shlx, y, shrx, y, sarx, y in Solidity assembly apply the shift operation of x bits on y and not the other way around, which may be confusing. Check if the values in a shift operation are reversed. Proof of Concept File: Drips.sol 823: val...
Upgraded Q -> 2 from #260 [1675460942583]
Judge has assessed an item in Issue 260 as 2 risk. The relevant finding follows: L2 Withdrawable minipool can be finished before funds are withdrawn --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #783 [1675429188655]
Judge has assessed an item in Issue 783 as 2 risk. The relevant finding follows: restakeGGP doesn't have whenNotPaused modifier At line 319 stakeGGP has whenNotPaused modifier, while restakeGGP has not. Suggest to add the same modifier to restakeGGP. --- The text was updated successfully, but the...
Anyone can withdraw contract funds
Lines of code Vulnerability details Impact There is a critical impact that an attacker could drain the entire eth balance of the contract by calling this refundETH function which lacks a modifier. The funds will go always to the caller of the function. Proof of Concept It is not a complex attack ...
Unchecked Return Values in SwapHelper.swap.
Lines of code Vulnerability details Impact SafeTransferLib.safeTransfertokenIn, msg.sender, amount0Delta 0 ? uint256amount0Delta : uint256amount1Delta; If the pool does not have enough liquidity, the UniswapV2Library functions will return a failure, but the SwapHelper.swap function does not...
Lack of access control in Lendgine.sol.withdraw()
Lines of code Vulnerability details Impact Because the function does not check if the person has access to it, anyone can call it. After calling the function the malicious user can increase his position. 175: positions.updatemsg.sender, -SafeCast.toInt256size, rewardPerPositionStored; He can then...
First liquidity provider will suffer from revert or fund loss
Lines of code Vulnerability details Impact The first liquidity depositor should supply three input values amount0Min, amount1Min, liquidity via AddLiquidityParams but these three values should meet an accurate relationship, or else the depositor will suffer from revert or fund loss Proof of Conce...
The LiquidityManager.pairMintCallback() might be exploited to steal funding from another user when the factory contract is compromised.
Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The LiquidityManager.pairMintCallback might be exploited to steal funding from another user due to three issues: 1. LiquidityManager.pairMintCallback is a callback function for the addLiquidity, which...
Lendgine contract can be drained through mint() function due to lack of Access Control
Lines of code Vulnerability details Impact Anybody can call the mint function on lendgine.sol and enter any amount of collateral. This allows them to mint any number of tokens to their address for free. Proof of Concept The mint function in lendgine.sol is external with no additional modifiers or...
Multiple combinations of token0/token1 for a given liquidity exist to satisfies the custom variant of AMM pool. A naive LP or Power token holder can transfer more token0/token1 then necessary when minting & burning respectively
Lines of code Vulnerability details Impact LP's need to provide a combination of token0 / token 1 for a given liquidity that satisfied a custom variant that satisfies 2 conditions 1. scale1 = c + d where a, b, c, d are functions of token0/ token1 , liquidity and upper bound The relationship betwe...
Upgraded Q -> M from #819 [1675276650768]
Judge has assessed an item in Issue 819 as M risk. The relevant finding follows: If we are going with this specific impact, looks like scenario 2 is valid - but does depend on Rialto making that mistake, so would say that is Medium. This is a duplicate, the primary issue being 723 --- The text wa...
Successful get balance request to victim contract from attack contract and also costing the victim contract gas fees
Lines of code Vulnerability details Impact Successful get balance request to victim contract from attack contract and also costing the victim contract gas fees One can view the balance of the victim's contract without permission. URL:...
Quest owner can withdraw the reward for unclaimed receipt.
Lines of code Vulnerability details Impact Erc1155Quest.withdrawRemainingTokens will withdraw all tokens even if there are users who minted a receipt but didn't claimed their rewards before endTime Proof of Concept Whitelisted account creates a new ERC1155 quest. Whitelisted account becames the...
Bad implementation in minter access control for RabbitHoleReceipt and RabbitHoleTickets contracts
Lines of code Vulnerability details Both RabbitHoleReceipt and RabbitHoleTickets contracts define a mint function that is protected by a onlyMinter modifier: RabbitHoleReceipt: function mintaddress to, string memory questId public onlyMinter tokenIds.increment; uint newTokenID = tokenIds.current;...
Mitigation of H-05: Issue not mitigated
Lines of code Vulnerability details Mitigation of H-05: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...
Mitigation of M-08: See comments
Lines of code Vulnerability details The PR applies the recommended mitigation from the finding, but the original finding's mitigation suggestion seems to indicated that the If two users place bids at the same price but with different quantities, the queue will pull from the bid with a higher...
All Transfer Hooks have incomplete checks which might lead to transactions reverting
Lines of code Vulnerability details Impact Due to not checking that the ids array and amounts array are same , if given the two arraya of non-equal length it might lead to incorrect token transfers and unwanted transaction reverts. Proof of Concept According to the EIP specification the ids array...
User can open position without depositing tokens
Lines of code Vulnerability details Impact User can mint long/short tokens without depositing anything. This is because the function on LN 172 doesn't check the contents of the returned data from the function, and the function doesn't verify that the contract has indeed received the expected...
Using V2-Pool, user can loose money after minting, then burn due to duration calculation
Lines of code Vulnerability details Impact Users loose money over time after mint using V2-Pool due to the protocol duration calculation. The current duration calculation is calculated from now to maturity. So when the user mint, then burn the liquidity, with time the amount of short he get is...
Allows burning from other accounts
Lines of code Vulnerability details Impact Anyone can burn the liquidamount before maturity by calling burn in Pool.sol Proof of Concept 364 : liquidityPosition.mintliquidityAmount; liquidityAmount is minted by liquidityPosition but when burned, it is not clear who will burn liquidityAmount 452: ...
reentrancy in TimeswapV2Option.collect()
Lines of code Vulnerability details Impact collect function doesn't respect the check-effect-interaction pattern, where in the case if a param.data is provided it makes an external call to the caller, right after that, it updates option short amount state. in the case if the caller calls back int...
User receives lesser number of Long Tokens on burning Pool liquidity resulting in loss of user funds
Lines of code Vulnerability details Impact Protocol currently uses 2 levels of callbacks for burning Pool liquidity: Inner callback - timeswapV2PoolBurnChoiceCallback function in Line 438 of Pool.sol allows user to specify long0 & long1 amount such that long0 + long1 longAmount. longAmount here...
Upgraded Q -> M from #72 [1674644492627]
Judge has assessed an item in Issue 72 as M risk. The relevant finding follows: Low-03 NTokenMoonBirds may not be able to receive airdrops Impact For most NToken, some airdrops that are actively minted to the holder's address can be withdrawn and later distributed by the PoolAdmin calling the...
Reentrancy attacks : if the functions in the interfaces are called in a malicious contract that calls back into the calling contract before the first call completes.
Lines of code Vulnerability details Impact Reentrancy attacks could be possible if the functions in the interfaces are called in a malicious contract that calls back into the calling contract before the first call completes. Proof of Concept A malicious contract is created that calls the...
Threat: Replay attack vulnerability
Lines of code Vulnerability details Impact The code does not check for the possibility of a replay attack on the contract, if the same order hash is being used multiple times Proof of Concept A replay attack is a type of attack where an attacker intercepts a valid transaction and resends it...
_locateCurrentAmount function, there is an unchecked block which skips underflow checks as startTime <= block.timestamp < endTime
Lines of code Vulnerability details Impact In the locateCurrentAmount function, there is an unchecked block which skips underflow checks as startTime = block.timestamp endTime, but if the condition is not upheld, the duration, elapsed, and remaining variables will underflow and can cause unexpect...
Lack of Input Validation in the Conduit Contract
Lines of code Vulnerability details Bug Description: The Conduit contract is a smart contract that serves as an originator for proxied transfers of ERC20, ERC721, and ERC1155 tokens. The contract's execute function takes an input of type ConduitTransfer calldata transfers which is an array of...