users funds will be stuck in the BaseBranchRouter when making deposit

Lines of code Vulnerability details Impact Users are debited twice the intended amount of every underlying token deposit made at the branch port while locking deposits into the branch port. The first deposit is transferred into the BaseBranchRouter and the second into the BranchPort. The funds...

Lack of proper access restrictions on functions setConcRewards() and setAmbRewards()

Lines of code Vulnerability details Impact Contract Reward distribution can be drained / manipulated Proof of Concept For setConcRewards and setAmbRewards, they are both lack of proper access restrictions, leads to the situation that anyone can execute these functions. This oversight presents a...

users will receive lesser rewards than they are supposed to.

Lines of code Vulnerability details Impact Due to risky math being used in the contract LiquidityMining.sol, the user could lose their rewards. Proof of Concept The calculation for user rewards in the LiquidityMining.sol Contract in multple instances divides the rewards earned by the user with a...

Airdropped Gas will remain in the Agent in case of failure

Lines of code Vulnerability details Impact The protocol uses LayerZeros Airdrop mechanism to send gas to BridgeAgents which they need to pay for subsequential cross-chain-messages. If the transaction on the receiver fails, this airdropped gas will remain in the BridgeAgent and can be used up by t...

LayerZero endpoint can get blocked by a malicious user (or even a honest one)

Lines of code Vulnerability details Description Contract Endpoint, from LayerZero is the one responsible of sending/receiving messages to/from other chains. Specifically it has function receivePayload, which is called by contract UltraLightNodeV2 the current default library of the protocol after...

Unexpected behavior when settings rewards for existing pools or past/ongoing periods

Lines of code Vulnerability details Summary There are different missing considerations in the liquidity mining process that may lead to unexpected behavior due to failed assumptions. Impact The liquidity mining feature is mainly implemented by tracking liquidity at a global level the aggregation ...

No poolIdx validation; arbitrary values can corrupt storage, require validation.

Lines of code Vulnerability details Impact No validation on poolIdx input for key functions like claimConcentratedRewards. Could pass invalid poolId and corrupt storage. The claimConcentratedRewards function is defined on LiquidityMining.sol. It takes in a poolIdx as one of the parameters functio...

accrueConcentratedPositionTimeWeightedLiquidity() can easily DOS due to the for loop in it

Lines of code Vulnerability details Impact accrueConcentratedPositionTimeWeightedLiquidity will iterate every single tick of a user's position. Since that total tick number can be large, this function can encounter a out of gas issue and users may not be able to claim the rewards properly. Proof ...

Rewards cannot be transferred when calling protocol command

Lines of code Vulnerability details Summary Rewards are set up using protocol commands, but it's entrypoint is not payable. Impact Rewards can be set up by protocol authorities using the functions setConcRewards and setAmbRewards present in the LiquidityMiningPath contracts. These two are part of...

Functions can be called directly externally

Lines of code Vulnerability details Impact @dev This exists as a standalone contract but will only ever contain proxy code, not state. As such it should never be called directly or externally, and should only be invoked with DELEGATECALL so that it operates on the contract state within the primar...

The Liquidity mining callpath sidecar owner can pull native tokens from the Dex

Lines of code Vulnerability details Impact The owner of liquidity mining sidecar can pull the native coins that are stored in the CrocSwapDex to reward the users. Proof of Concept The setConcRewards and setAmbRewards functions doesn't check if the quoted amount of rewards are actually sent by the...

Front-Running Vulnerability: Exploiting Reward Updates for Maximized Payouts

Lines of code Vulnerability details Impact Malicious users claim rewards at a higher rate than what was intended by front-running governance actions meant to reduce rewards. This allows them to claim rewards at a higher rate than what was intended, undermining the protocol's intended economic...

Use of flashloan to inflate timeWeightedWeeklyGlobalAmbLiquidity_[poolIdx][currWeek] and timeWeightedWeeklyPositionAmbLiquidity_[poolIdx][posKey][currWeek]

Lines of code Vulnerability details Impact It is possible for a bad player to use flashloan to manipulate the system by making "valuable" LP to get lower reward than expected, while they get a minimal reward for a liquidity provided that offers no "value" to Ambient DEX. This attack will thrive...

If dt is not updated accurately then timeWeightedWeeklyPositionInRangeConcLiquidity_ might be updated incorrectly.

Lines of code Vulnerability details Impact In the function accrueConcentratedPositionTimeWeightedLiquidity, inside the while block, dt is initialised as: uint32 dt = uint32 nextWeek If tickTracking.exitTimestamp != 0 then the following else block is executed on line 117: else // Tick is no longer...

Slippage attack on claiming rewards

Lines of code Vulnerability details Impact Exploiter can abuse slippage to claim more weekly reward. The amount of slippage damage is unclear due to lack of deployment context and testing. Worst case scenario is the exploiter own 100% deposit of single pool allowing extreme slippage to steal enti...

Anyone can create multiple RootBridgeAgent

Lines of code Vulnerability details Impact createBridgeAgent is used to create a new Root Bridge Agent. This new RootBridgeAgent is added to the array on the rootPort. This can be used to randomly spam the array with thousand of array addresses whereby the ones deployed by the protocol are harder...

Rounding error leading to no reward being sent

Lines of code Vulnerability details Impact Rounding errors could occur if the provided amount is too small, Proof of Concept rewardsToSend += inRangeLiquidityOfPosition concRewardPerWeekpoolIdxweek / overallInRangeLiquidity; uint256 rewardsForWeek = timeWeightedWeeklyPositionAmbLiquidity poolIdx...

deleted

Lines of code Vulnerability details deleted Assessed type Other --- The text was updated successfully, but these errors were encountered: All reactions...

Lack of validation allows invalid ticks, impacting data integrity.

Lines of code Vulnerability details Impact Function crossTicks updates the tick tracking data when ticks are crossed, but does not validate that exitTick and entryTick are valid and make sense. For example, exitTick could be lower than entryTick. Proof of Concept Here is the relevant code in the...

Logic Error

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Manual Recommended Mitigation Steps...

No access control on protocolCmd and userCmd; potential for abuse.

Lines of code Vulnerability details Impact There is no access control on the protocolCmd and userCmd functions in LiquidityMiningPath. This means anyone can call them. There should be some checks to restrict access. The protocolCmd and userCmd functions are defined on LiquidityMiningPath.sol: /...

Unbounded tick arrays; add max length check to prevent gas issues.

Lines of code Vulnerability details Impact Tick arrays like tickTracking can grow unbounded. Could hit gas limit. As ticks are crossed, new TickTracking elements are pushed: function crossTicks bytes32 poolIdx, int24 exitTick, int24 entryTick internal tickTrackingpoolIdxexitTick.push...

BranchBridgeAgent.retrieveDeposit doesn't check if the deposit is in FAILED state

Lines of code Vulnerability details Impact The BranchBridgeAgent.retrieveDeposit function is supposed to be called for retrieving a failed deposit in order to get funds back to branch chain, but the function doesn't check that the deposit being used is really in FAILED state, so a malicious user...

LiquidityMining.claimConcentratedRewards() does not properly account user liquidity across ticks

Lines of code Vulnerability details Let’s say a user creates two separate positions, one is tick-15, tick and the second is tick, tick+15. The user is covering the entirety of the tick range to receive rewards but does not receive any. We see that posKey is defined like this: bytes32 posKey =...

LACK OF INPUT VALIDATION ON THE _recipient ADDRESS IN THE RootBridgeAgent.retrySettlement FUNCTION CAN LEAD TO LOSS OF FUNDS TO THE USER

Lines of code Vulnerability details Impact The RootBridgeAgent.retrySettlement function is used to retry the settlement of tokens by the settlement owner. The retrySettlement function is an external payable function which does not have access control, hence can be called by any settlement owner b...

Access control check in the setAmbRewards and setAmbRewards functions is missing

Lines of code Vulnerability details Impact Any user can call the setAmbRewards and setAmbRewards functions and set their values for weeklyReward, which opens up many attack vectors. For example, it is possible to set a large reward and withdraw all funds from the protocol. Proof of Concept functi...

if the Virtual Account's owner is a Contract Account (multisig wallet), attackers can gain control of the Virtual Accounts by gaining control of the same owner's address in a different chain

Lines of code Vulnerability details Impact Attackers can gain control of User's Virtual Accounts and steal all the assets these accounts hold in the Root environment Proof of Concept When sending signed messages from a Branch to Root, the RootBridgeAgent contract calls the...

Lack of validation in accrued index allows excess rewards claim.

Lines of code Vulnerability details Impact Mapping tickTrackingIndexAccruedUpTo tracks the index up to which rewards have been accrued for a position. However, there is no validation that this index is incremented properly and stays in sync with tickTracking. An attacker could manipulate the...

Unprotected payableCall() exposes user funds to malicious actors

Lines of code Vulnerability details Impact The function payableCall is used to make calls on to other contracts from the virtualAccount which is linked to a userAddress. This function utilizes the PayableCall struct show below. struct PayableCall address target; bytes callData; uint256 value; It...

Missing Access Control on setConcRewards and setAmbRewards

Lines of code Vulnerability details Impact The function setConcRewards and setAmbRewards are accessible by any user to set the rewardsConcentrated and Ambient rewards. Proof of Concept The access validations are commented out. function setConcRewardsbytes32 poolIdx, uint32 weekFrom, uint32 weekTo...

VirtualAccount::payableCall is missing access control

Lines of code Vulnerability details Impact The lack of access control in VirtualAccount::payableCall function allows anyone to execute arbitrary calls with any contract from a user's VirtualAccount. This enables malicious actors to steal user's funds easily, ultimately resulting in a...

The while loop used in all the accrueXXXPositionTimeWeightedLiquidity function could make a call reach the block gas limit

Lines of code Vulnerability details Proof of Concept If a user neither modifies his position nor claims rewards for a very long time, it might become impossible for him to do any action involving the internal functions accrueAmbientPositionTimeWeightedLiquidity or...

VirtualAccount.sol CONTRACT DOES NOT CORRECTLY IMPLEMENT THE eip1155 STANDARD WHILE INHERITING THE ERC1155Receiver

Lines of code Vulnerability details Impact The VirtualAccount.sol contract inherits the ERC1155Receiver contract to receive the ERC1155 tokens. Both onERC1155Received and onERC1155BatchReceived functions are declared in the VirtualAccount contract as per the eip1155 standard. The respective ERC11...

[M-15] Reentrancy in the BranchPort contract

Lines of code Vulnerability details Impact In a Re-entrancy attack, a malicious contract calls back into the calling contract before the first invocation of the function is finished. This may cause the different invocations of the function to interact in undesirable ways, especially in cases wher...

RootBridgeAgent.retrieveSettlement doesn't check if settlement is in FAILED state

Lines of code Vulnerability details Impact The RootBridgeAgent.retrieveSettlement function is supposed to be used to retrieve a failed settlement to be able to redeem it but because the function doesn't actually check that the input settlement is in fact in FAILED state, the function can be used ...

A Malicious user can create a rootBridgeAgent with a malicious endpoint and execute calls directly with the rootBridgeAgent.

Lines of code Vulnerability details Impact A Malicious user can create a rootBridgeAgent with a malicious endpoint and execute calls directly with the rootBridgeAgent. Since anyone can create a rootBridgeAgent with desired values for port, endpoint and router address in anychain. The Attacker can...

All tokens can be stolen from VirtualAccount due to missing access modifier

Lines of code Vulnerability details Impact All non-native assets ERC20 tokens, NFTs, etc. can be stolen by anyone from a VirtualAccount using its payableCall... method, which lacks the necessary access control modifier requiresApprovedCaller. See also, the call... method which utilizes the...

Liquidity providers may recieve wrong rewards due to loss of precision in the calculation of currWeek and nextWeek.

Lines of code Vulnerability details Throughout LiquidityMining.sol the values for currWeek and nextWeek are generated using the lastAccrued timestamp embedded in a local variable time. currWeek is determined by uint32 currWeek = uint32time / WEEK WEEK; And nextWeek is calculated by uint32 nextWee...

A malicious user can spam ghost deposits to DoS the LayerZeroEndpoint messaging layer

Lines of code Vulnerability details Impact There can be many deposits that will strain the messaging layer, especially in chains that do not cost much to send a transaction. Proof of Concept The entry point of the bridge is callOutSignedAndBridge in BranchBridgeAgent.sol. This function will pack...

FallBack Function might revert

Lines of code Vulnerability details The performFallbackCall function appears to be designed to send a message to the RootBridgeAgent using the lzReceive function. It includes the settlement nonce encoded as part of the message. Overall, the function seems fine for its intended purpose, but there...

users can make multiple deposits through the same deposit nonce in branch bridge agent

Lines of code Vulnerability details Impact When a user retries the deposit there is a check that the deposit owner should be msg.sender but there is no check that the deposit failed so user can even retry successful deposits with the same nonce which can affect accounting badly Proof of Concept...

Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fund

Lines of code Vulnerability details Impact Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fun Proof of Concept One of the cross-chain request pass is that when user calling callOutSignedAndBridge via BranchBridgeAgent the payload is created //Encode Data for...

[M-17] Reentrancy in the BranchBridgeAgent contract

Lines of code Vulnerability details Impact In a Re-entrancy attack, a malicious contract calls back into the calling contract before the first invocation of the function is finished. This may cause the different invocations of the function to interact in undesirable ways, especially in cases wher...

ChainLink should be used as an Oracle for messaging instead of Google Cloud

Lines of code Vulnerability details Impact Each User Application contract e.g. BranchBidgeAgent built on LayerZero will work without configuration using defaults, but a UA will also be able to configure its own. Maia intends to use the default config. However, Google Cloud Oracle is the default a...

Cross-Chain Token Cap Disparity

Lines of code Vulnerability details Impact Potential loss of token value when minted values exceed the uint capacity of target chains, leading to incorrect token representation and financial discrepancies. Proof of Concept This function mints tokens or at least a representation of other chain...

code written in MulticallRootRouter.sol is wrong .

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps 0x01 |...

CrossTicks is not called when Users claimConcentratedRewards.

Lines of code Vulnerability details Vulnerability Details The crossTicks function is called to keep track and update the ticks whenever a tick is crossed, as specified by the Natspec /// @notice Keeps track of the tick crossings /// @dev Needs to be called whenever a tick is crossed function...

add sendBack function to origin when lzReceiveNonBlocking is not executed

Lines of code Vulnerability details Impact lzReceiveNonBlocking won't revert to the ILayerZeroEndpoint.send could lead to that execution on side of send is exectued and execution on side of receieve is not executed. Proof of Concept Tools Used manual view Recommended Mitigation Steps if calls are...

User can selectively turn on the fallback flag to take all ETH on the agent contract as layerzero fee refund

Lines of code Vulnerability details Impact performFallbackCall can revert sliently when refundee is not capable of taking ETH refund from layerzero side Proof of Concept In RootBridgeAgent.sol when the has fall back toggle flag is on, the smart contract aim to perform a fallback call to notify th...

Irrevocable token holders can instantly mint a revocable token after burning and bypass the minimum XVS stake for revocable tokens

Lines of code Vulnerability details Impact When an irrevocable token is burned by the admin, the holder should go through the 90 day staking period again before accruing rewards. However, the holder can exploit the protocol to immediately begin accruing rewards after burning. Furthermore, the...