10190 matches found
limits_.sum is not increased yet when performing limit check. Collateral may exceed the limit.
Lines of code Vulnerability details Impact limits.sum is not increased yet when performing limit check. Collateral may exceed the limit. There is a limit on how much collateral can be concurrently put at auction, but it is a soft limit. If the limit has been surpassed, no more vaults of that...
There is no boundaries for starting an auction.
Lines of code Vulnerability details Impact The team has brought this contest to be fairer to their users in terms of liquidation mechanism. Looking through this perspective, it can be developed more on the process to be much fairer to the users in volatile market conditions. Proof of Concept The...
On the auction function start time is not set
Lines of code Vulnerability details Impact During the code review, It has been noticed that auction start time block.timestamp is not set. All pay functions are checking If the auction.start is more than zero. From that reason, auction start time should be set at auction function. Proof of Concep...
Upgraded Q -> M from 358 [1657932904826]
Judge has assessed an item in Issue 358 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 190 [1657955157754]
Judge has assessed an item in Issue 190 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 358 [1657932899986]
Judge has assessed an item in Issue 358 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 306 [1657954489063]
Judge has assessed an item in Issue 306 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Attacker Can Front-run auction() To Modify Auctioneer Reward Receiver Address
Lines of code Vulnerability details Impact An attacker can front-run the auctioneerās call to auction with another address to to receive the auctioneer reward instead of the original caller. Proof of Concept 1. Alice wants to liquidate a specific vault. 2. Mallory observes Alice's auction...
ladle address change can lead to fail other functionalities
Lines of code Vulnerability details Impact for ongoing auctions, it will not return any join. Proof of Concept Tools Used Manual Analysis Recommended Mitigation Steps add checks or set proper mechanism before change ladle address --- The text was updated successfully, but these errors were...
User can set auctioneer to address(0) to prevent vault from being liquidated
Lines of code Vulnerability details Impact Vault cannot be liquidated Proof of Concept auction can be called with any address as the 'to' address. A majority of ERC20 tokens will revert if a transfer is initiated to address0, notably, including USDC. Since the auctioneer is paid each time a payme...
Upgraded Q -> M from 316 [1657933321396]
Judge has assessed an item in Issue 316 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 253 [1657932408647]
Judge has assessed an item in Issue 253 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 153 [1657934352278]
Judge has assessed an item in Issue 153 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Concurrently auctioned collateral limit can be gamed
Lines of code Vulnerability details Proof of concept: Letās say for collateral USDT we put a limit that maximum concurrent auctioned collateral can be 100,000 USDT. Now if there are two big vaults, one is 9,999 USDT and other is 100,000 USDT and they are both undercollateralized, now if someone...
Upgraded Q -> M from 253 [1657932404226]
Judge has assessed an item in Issue 253 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 279 [1657955636898]
Judge has assessed an item in Issue 279 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 233 [1657954928095]
Judge has assessed an item in Issue 233 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
ZcToken.withdraw() and ZcToken.redeem() will always revert when msg.sender != holder.
Lines of code Vulnerability details Impact ZcToken.withdraw and ZcToken.redeem will always revert when msg.sender != holder. These 2 functions will work only when users withdraw/redeem from their balances. Proof of Concept When we check allowance here, it reverts when allowance is greater than...
Upgraded Q -> M from 219 [1657897148559]
Judge has assessed an item in Issue 219 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Incorrect check in ZcToken.withdraw and ZcToken.redeem leads to underlying tokens not being able to be transferred
Lines of code Vulnerability details Incorrect check in ZcToken.withdraw and ZcToken.redeem leads to underlying tokens not being able to be transferred In both ZcToken.withdraw and ZcToken.redeem, in the case where holder != msg.sender, a check of the msg.sender's ZcToken allowance is performed. B...
Upgraded Q -> M from 228 [1657895129928]
Judge has assessed an item in Issue 228 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Swivel.sol is missing authRedeem() function called in Marketplace.sol
Lines of code Vulnerability details Impact A user redeems or withdraws from their ZcToken by calling ZcToken.withdraw or ZcToken.redeem. Both of these functions then call MarketPlace.authRedeem which in turn calls Swivel.authRedeem. The issue is that Swivel.sol does not have an authRedeem functio...
Invalid testing of allowance in ZcToken.withdraw and ZcToken.redeem
Lines of code Vulnerability details Impact / Description In the ZcToken contract, the withdraw and redeem methods both support being called from an other account with an appropriate allowance set, but these functions fail to properly validate allowance. The problem is the condition allowed = amou...
MarketPlace - authRedeem does not work
Lines of code Vulnerability details Impact The redeem process looks broken, impacting one of the core functionality of the protocol. Proof of Concept The redeem process is the following: User calls redeem or withdraw in ZcToken, which forwards the call to MarketPlace, which calls...
Upgraded Q -> M from 417 [1657853118593]
Judge has assessed an item in Issue 417 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Not safe transferFrom
Lines of code Vulnerability details Impact The Safe library says: @dev Caution! This library won't check that a token has code, responsibility is delegated to the caller. But this check is not made in Swivel contract, so the Safe library it's prone to phantom methods attacks. Supposedly it is a...
Upgraded Q -> M from 330 [1657894715614]
Judge has assessed an item in Issue 330 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Functions of MarketPlace.sol will always revert
Lines of code Vulnerability details Impact Functions which call VaultTracker admin functions e.g. addNotional from MarketPlace will always revert since the admin is Creator. Proof of Concept VaultTracker.sol has an authorizedadmin modifier which only allows admin to call these functions. And the...
Allowance should always larger or equal to the transferred amount
Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Wrong operators are set. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Line 111 - 115 if allowe...
Funds can be stuck or lost if address(this)or address(0) is passed as to`
Lines of code Vulnerability details Impact Funds can be stuck or lost. Proof of Concept There is no checks to prevent to == addressthis or to == address0. This might lead to funds being stuck in the contract or lost. function auctionbytes12 vaultId, address to external returns DataTypes.Auction...
VaultTracker miscalculates compounding interest
Lines of code Vulnerability details Impact VaultTracker neglect previously accrued interest while attempting to calculate new interest. This causes nToken holders to receive less yield than they should. All functions within VaultTracker that calculate interest are affected, including addNotional,...
Wrong allowance logic
Lines of code Vulnerability details Impact The logic around the decrementing the allowance in the withdraw and redeem methods of the contract ZcToken are wrong implemented and cannot be used. Proof of Concept There are a Denial of Service in the withdraw and redeem methods of the ZcToken contract...
Upgraded Q -> M from 330 [1657894706461]
Judge has assessed an item in Issue 330 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Incorrect check for signature malleability
Lines of code Vulnerability details Impact Sig.recover has an Incorrect check: c.v != 27 || c.v != 28. Thus, Sig.recover always reverts. Proof of Concept c.v != 27 || c.v != 28 is always true function recoverbytes32 h, Components calldata c internal pure returns address // EIP-2 and malleable...
minInkOut parameter will likely cause revert
Lines of code Vulnerability details Impact In payBase, the user is able to supply maxBaseIn and minInkOut params. There is logic in the function that if the user has attempted to send more base than the cauldron currently needs, then it only takes the amount of base necessary. // If offering too...
Collateral limit can be exceeded on a new auction
Lines of code Vulnerability details Witch's auction checks the total collateral limit before updating the structure with the current auction's data. This way this limit end up not being respected in result of auction call and can be actually breached for an arbitrary big amount as auction.ink tha...
Upgraded Q -> M from 277 [1657879283610]
Judge has assessed an item in Issue 277 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Accidentally cancel order
Lines of code Vulnerability details Accidentally cancel order Impact Some market maker's limit order might be accidentally cancelled, and has to be resubmitted again. If the user did not do this on purpose, without knowing the fact that the order has been cancelled, it may lead to unexpected...
Implementation does not exist
Lines of code fd36ce96b46943026cb2dfcb76dfa3f884f51c18/Marketplace/MarketPlace.solL156 Vulnerability details Impact ZcToken.withdraw and ZcToken.redeem will be reverted. Proof of Concept In ZcToken.withdraw and ZcToken.redeem, it calls redeemer.authRedeem. redeemer can be MarketPlace here. But...
Upgraded Q -> M from 277 [1657879288067]
Judge has assessed an item in Issue 277 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 163 [1657895640147]
Judge has assessed an item in Issue 163 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
IF A SINGLE ORDER FAILS, THE WHOLE FUNCTION REVERTS
Lines of code Vulnerability details Impact If a single order of the orders array fails, the whole function initiate or exit reverts with no information about which was the vulnerable order, the only information given is an Exception with a code of 5 Proof of Concept Tools Used editor Recommended...
Cannot withdraw or redeem approved tokens
Lines of code Vulnerability details Title Cannot withdraw or redeem approved tokens Impact A contract/EOA which has been approved some ZcToken cannot redeem or withdraw the approved tokens since these functions always revert if msg.sender != holder. Proof of Concept In the withdraw function...
Upgraded Q -> M from 118 [1657878801501]
Judge has assessed an item in Issue 118 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
With most functions in VaultTracker.sol, users can call them only once after maturity has been reached.
Lines of code Vulnerability details Impact With most functions in VaultTracker.sol, users can call them only once after maturity has been reached. So from the second call of any functions after maturity, it will revert and users might lose their funds or interests. Proof of Concept The main probl...
Upgraded Q -> M from 340 [1657877639047]
Judge has assessed an item in Issue 340 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 390 [1657876451641]
Judge has assessed an item in Issue 390 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from 219 [1657897144347]
Judge has assessed an item in Issue 219 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...