Permissive owner access allows misleading URI changes, impacting user trust.

Lines of code Vulnerability details Impact setUri function is only restricted to the contract owner, this could allow the owner to update the URI and make changes that users did not anticipate. The setUri function allows the owner to update the URI to anything they want. For example, they could...

Assembly proxy creation lacks bytecode validation, enabling arbitrary contract deployment.

Lines of code Vulnerability details Impact The proxy contract creation uses assembly to compute the create2 address. But it does not verify the deployed bytecode matches expectations. The use of assemble for proxy contract creation has potential risks if the bytecode is not validated. This could...

Existing pools will be bricked due to uninitialized state

Lines of code Vulnerability details Existing pools will be bricked due to uninitialized Summary Pools already present in the exchange will be bricked when crossTicks is called with an uninitialized tickTracking storage, which will trigger an array out of bounds error. Impact New pools in the...

The while loop used in all the accrueXXXPositionTimeWeightedLiquidity function could make a call reach the block gas limit

Lines of code Vulnerability details Proof of Concept If a user neither modifies his position nor claims rewards for a very long time, it might become impossible for him to do any action involving the internal functions accrueAmbientPositionTimeWeightedLiquidity or...

Reentrancy is possible in claim functions, which call out via .call().

Lines of code Vulnerability details Impact Reentrancy is possible in claim functions, which call out via .call. Proof of Concept The claimConcentratedRewards Function & claimAmbientRewards Function The claim functions that are vulnerable to reentrancy are: For...

if lzReceiveNonBlocking failed to execute , they don't send back ,accumulated msg.value . malicious user drain that

Lines of code Vulnerability details Impact PerformFallBack is gonna fail and msg.value will be accumulated in that BranchBridgeAgent and malicious user can take over them Proof of Concept User deposited and When it's not executed ,user want to retrieve and callRetrieveSettlement ,send message to...

Use of flashloan to inflate timeWeightedWeeklyGlobalAmbLiquidity_[poolIdx][currWeek] and timeWeightedWeeklyPositionAmbLiquidity_[poolIdx][posKey][currWeek]

Lines of code Vulnerability details Impact It is possible for a bad player to use flashloan to manipulate the system by making "valuable" LP to get lower reward than expected, while they get a minimal reward for a liquidity provided that offers no "value" to Ambient DEX. This attack will thrive...

Users may be unable to claim their rewards and add/remove liquidity due exceeding gas limit

Lines of code Vulnerability details Impact If a user provides liquidity on ticks which are entered and exited a large number of times, the gas required to call the accrueConcentratedPositionTimeWeightedLiquidity can exceed the block gas limit. Proof of Concept The...

Gas that was sent by LayerZero can get stuck in the contract in some cases

Lines of code Vulnerability details If a tx on the destination chain calls back the chain from where the transaction was initiated by the user, the first transaction on the source chain needs to "airdrop" gas to the destination chain so it is able to call back the source chain. The problem is tha...

USAGE OF abi.encodePacked TO ENCODE DATA COULD LEAD TO payload DATA COLLISION IN THE RootBridgeAgent._createSettlementMultiple FUNCTION

Lines of code Vulnerability details Impact The RootBridgeAgent.callOutAndBridgeMultiple function is used to settle multiple assets and perform a remote call to a branch chain. callOutAndBridgeMultiple function calls the RootBridgeAgent.createSettlementMultiple internal function to compute the...

Global and Position liquidity accrual can significantly impact the performance

Lines of code Vulnerability details Impact Global and Position liquidity accrual can significantly impact the performance Proof of Concept The calculation of currWeek and nextWeek as shown in the provided code snippet aims to determine two time points within a week, primarily for the purpose of...

Access control check in the setAmbRewards and setAmbRewards functions is missing

Lines of code Vulnerability details Impact Any user can call the setAmbRewards and setAmbRewards functions and set their values for weeklyReward, which opens up many attack vectors. For example, it is possible to set a large reward and withdraw all funds from the protocol. Proof of Concept functi...

[M-14] Reentrancy in the RootBridgeAgent contract

Lines of code Vulnerability details Impact In a Re-entrancy attack, a malicious contract calls back into the calling contract before the first invocation of the function is finished. This may cause the different invocations of the function to interact in undesirable ways, especially in cases wher...

Virtual account lacks access control

Lines of code Vulnerability details Impact The Virtual Account lacks access control on a function that allows arbitrary calls. This enables anyone to take any assets contained within the account. Proof of Concept The Virtual account has the requiresApprovedCaller modifier to prevent use from...

[M-17] Reentrancy in the BranchBridgeAgent contract

Lines of code Vulnerability details Impact In a Re-entrancy attack, a malicious contract calls back into the calling contract before the first invocation of the function is finished. This may cause the different invocations of the function to interact in undesirable ways, especially in cases wher...

[M-16] Reentrancy in the BaseBranchRouter contract

Lines of code Vulnerability details Impact In a Re-entrancy attack, a malicious contract calls back into the calling contract before the first invocation of the function is finished. This may cause the different invocations of the function to interact in undesirable ways, especially in cases wher...

Mismatch of decimals for some underlying tokens across chains could cause a huge loss of funds

Lines of code Vulnerability details Impact The issue is, some ERC20 underlying tokens could have different decimals on other chains. For example, USDC in BNB chain has 18 decimals where it has 6 decimals in other chains such as Ethereum, Polygon ...etc. The root chain doesn't account for decimals...

Slippage attack on claiming rewards

Lines of code Vulnerability details Impact Exploiter can abuse slippage to claim more weekly reward. The amount of slippage damage is unclear due to lack of deployment context and testing. Worst case scenario is the exploiter own 100% deposit of single pool allowing extreme slippage to steal enti...

A Malicious user can create a rootBridgeAgent with a malicious endpoint and execute calls directly with the rootBridgeAgent.

Lines of code Vulnerability details Impact A Malicious user can create a rootBridgeAgent with a malicious endpoint and execute calls directly with the rootBridgeAgent. Since anyone can create a rootBridgeAgent with desired values for port, endpoint and router address in anychain. The Attacker can...

[M-15] Reentrancy in the BranchPort contract

Lines of code Vulnerability details Impact In a Re-entrancy attack, a malicious contract calls back into the calling contract before the first invocation of the function is finished. This may cause the different invocations of the function to interact in undesirable ways, especially in cases wher...

Unexpected behavior when settings rewards for existing pools or past/ongoing periods

Lines of code Vulnerability details Summary There are different missing considerations in the liquidity mining process that may lead to unexpected behavior due to failed assumptions. Impact The liquidity mining feature is mainly implemented by tracking liquidity at a global level the aggregation ...

if the Virtual Account's owner is a Contract Account (multisig wallet), attackers can gain control of the Virtual Accounts by gaining control of the same owner's address in a different chain

Lines of code Vulnerability details Impact Attackers can gain control of User's Virtual Accounts and steal all the assets these accounts hold in the Root environment Proof of Concept When sending signed messages from a Branch to Root, the RootBridgeAgent contract calls the...

Using .call for external calls leaves the contract vulnerable to reentrancy.

Lines of code Vulnerability details Impact claimConcentratedRewards and claimAmbientRewards call external contracts via call. This could leave the contract vulnerable to reentrancy attacks if the recipient contract calls back into the contract before updating state. Proof of Concept The calls to...

Liquidity providers may recieve wrong rewards due to loss of precision in the calculation of currWeek and nextWeek.

Lines of code Vulnerability details Throughout LiquidityMining.sol the values for currWeek and nextWeek are generated using the lastAccrued timestamp embedded in a local variable time. currWeek is determined by uint32 currWeek = uint32time / WEEK WEEK; And nextWeek is calculated by uint32 nextWee...

CoreRootRouter.executeDepositSingle FUNCTION REVERTS FOR SINGLE ASSETS DEPOSITS THUS FAILING THE TRANSACTION

Lines of code Vulnerability details Impact The RootBridgeAgent.lzReceiveNonBlocking function calls the respective RootBridgeAgentExecutor functions based on the flag parsed via the payload0. The payload0 == 0x02 stands for the Call with Deposit remote call. The...

Functions can be called directly externally

Lines of code Vulnerability details Impact @dev This exists as a standalone contract but will only ever contain proxy code, not state. As such it should never be called directly or externally, and should only be invoked with DELEGATECALL so that it operates on the contract state within the primar...

If dt is not updated accurately then timeWeightedWeeklyPositionInRangeConcLiquidity_ might be updated incorrectly.

Lines of code Vulnerability details Impact In the function accrueConcentratedPositionTimeWeightedLiquidity, inside the while block, dt is initialised as: uint32 dt = uint32 nextWeek If tickTracking.exitTimestamp != 0 then the following else block is executed on line 117: else // Tick is no longer...

BranchBridgeAgent.retrieveDeposit doesn't check if the deposit is in FAILED state

Lines of code Vulnerability details Impact The BranchBridgeAgent.retrieveDeposit function is supposed to be called for retrieving a failed deposit in order to get funds back to branch chain, but the function doesn't check that the deposit being used is really in FAILED state, so a malicious user...

Time-weighted liquidity accounting assumes consecutive activity; double counting possible, needs validation.

Lines of code Vulnerability details Impact Time-weighted liquidity accounting in accrueConcentratedPositionTimeWeightedLiquidity and similar functions assumes ticks were active consecutively between entry/exit timestamps. However, a tick could exit and re-enter in the same week, leading to double...

Airdropped Gas will remain in the Agent in case of failure

Lines of code Vulnerability details Impact The protocol uses LayerZeros Airdrop mechanism to send gas to BridgeAgents which they need to pay for subsequential cross-chain-messages. If the transaction on the receiver fails, this airdropped gas will remain in the BridgeAgent and can be used up by t...

Incorrect functionID will not trigger fallback

Lines of code Vulnerability details Impact When encoding a payload for settlement of multiple tokens, the fallback flag is not set when it should be. This will cause no fallback to be triggered even though the user has paid enough to cover the additional costs that are required. Proof of Concept ...

Unvalidated ticks in claimConcentratedRewards allow unauthorized users to claim undeserved rewards. Validate ticks.

Lines of code Vulnerability details Impact There is no check that the ticks passed into claimConcentratedRewards actually match the position's ticks. A user could pass in arbitrary ticks to try to claim rewards for liquidity they don't own. Proof of Concept The claimConcentratedRewards function...

Rewards cannot be transferred when calling protocol command

Lines of code Vulnerability details Summary Rewards are set up using protocol commands, but it's entrypoint is not payable. Impact Rewards can be set up by protocol authorities using the functions setConcRewards and setAmbRewards present in the LiquidityMiningPath contracts. These two are part of...

code written in MulticallRootRouter.sol is wrong .

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps 0x01 |...

No access control on protocolCmd and userCmd; potential for abuse.

Lines of code Vulnerability details Impact There is no access control on the protocolCmd and userCmd functions in LiquidityMiningPath. This means anyone can call them. There should be some checks to restrict access. The protocolCmd and userCmd functions are defined on LiquidityMiningPath.sol: /...

Limit accrueConcentratedPositionTimeWeightedLiquidity calls to prevent reward manipulation.

Lines of code Vulnerability details Impact It may be possible for a user to artificially increase their tracked liquidity right before claiming by rapidly entering/exiting positions. This could allow them to claim a larger % of rewards than they deserve. Proof of Concept The main risk of...

ChainLink should be used as an Oracle for messaging instead of Google Cloud

Lines of code Vulnerability details Impact Each User Application contract e.g. BranchBidgeAgent built on LayerZero will work without configuration using defaults, but a UA will also be able to configure its own. Maia intends to use the default config. However, Google Cloud Oracle is the default a...

VirtualAccount::payableCall is missing access control

Lines of code Vulnerability details Impact The lack of access control in VirtualAccount::payableCall function allows anyone to execute arbitrary calls with any contract from a user's VirtualAccount. This enables malicious actors to steal user's funds easily, ultimately resulting in a...

Lack of Access Control in public function VirtualAccount.payableCall

Lines of code Vulnerability details Description The VirtualAccount contract allows users to manage assets and perform interactions remotely while maintaining an encapsulated user balance. The contract includes a payableCall function that aggregates and executes a batch of calls to external...

LiquidityMining.sol cannot be funded for rewards distribution.

Lines of code Vulnerability details During a rewards claim LiquidityMining.sol uses a low-level call with the msg.value as the rewardsToSend to the liquidity providers, but the contract lacks a receive or fallback function for funds be deposited in it, leaving the contract empty and unable to sen...

deleted

Lines of code Vulnerability details deleted Assessed type Other --- The text was updated successfully, but these errors were encountered: All reactions...

LiquidityMining.claimConcentratedRewards() does not properly account user liquidity across ticks

Lines of code Vulnerability details Let’s say a user creates two separate positions, one is tick-15, tick and the second is tick, tick+15. The user is covering the entirety of the tick range to receive rewards but does not receive any. We see that posKey is defined like this: bytes32 posKey =...

All tokens can be stolen from VirtualAccount due to missing access modifier

Lines of code Vulnerability details Impact All non-native assets ERC20 tokens, NFTs, etc. can be stolen by anyone from a VirtualAccount using its payableCall... method, which lacks the necessary access control modifier requiresApprovedCaller. See also, the call... method which utilizes the...

Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fund

Lines of code Vulnerability details Impact Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fun Proof of Concept One of the cross-chain request pass is that when user calling callOutSignedAndBridge via BranchBridgeAgent the payload is created //Encode Data for...

Lack of validation allows invalid ticks, impacting data integrity.

Lines of code Vulnerability details Impact Function crossTicks updates the tick tracking data when ticks are crossed, but does not validate that exitTick and entryTick are valid and make sense. For example, exitTick could be lower than entryTick. Proof of Concept Here is the relevant code in the...

users will receive lesser rewards than they are supposed to.

Lines of code Vulnerability details Impact Due to risky math being used in the contract LiquidityMining.sol, the user could lose their rewards. Proof of Concept The calculation for user rewards in the LiquidityMining.sol Contract in multple instances divides the rewards earned by the user with a...

require statement commented posses attack by malicious contract

Lines of code Vulnerability details Impact The 'require' statement commented posses attack by malicious contract. The LiquidityMiningPath.sol contract has the Governance requirement of the ‘require’ statement commented. If the intention was to make use of the ‘require’ statement, uncomment it so ...

Many issues around addGlobalToken due to lack of input validation when linking a global token to local token

Lines of code Vulnerability details Impact addGlobalToken is used to add a global token to a branch. The flow as follows: 1 = CoreBranchRouter.addGlobalToken 2 = Send Cross-Chain request System Response/Request with FuncId 0x01 Notice that is uses normal callOut though. Anyway, let's continue...

Cross-Chain Token Cap Disparity

Lines of code Vulnerability details Impact Potential loss of token value when minted values exceed the uint capacity of target chains, leading to incorrect token representation and financial discrepancies. Proof of Concept This function mints tokens or at least a representation of other chain...

Lack of tick range validation allows initialization of invalid ticks.

Lines of code Vulnerability details Impact Function initTickTracking initializes the tick tracking data structure, but does not validate that tick is within the min/max tick range for the pool. This could allow initializing invalid tick values. Proof of Concept Here is the line in initTickTrackin...