safe32 WILL RESTRICT THE DURATION OF MultiRewardDistributor._addEmissionConfig FUNCTION USABILITY

Lines of code Vulnerability details Impact The MultiRewardDistributor.addEmissionConfig function is used to add a new emission configuration for a specific market. The addEmissionConfig function constructs the MarketConfig configuration struct using the input parameters to the function. The...

Current setUnderlyingPrice and setDirectPrice open to incorrect liquidation of users' positions and result in financial losses for users

Lines of code Vulnerability details Impact Price feeds can be affected by network congestion, causing transactions with outdated prices to be treated as current prices. As price feeds are crucial to the protocol's functioning, this situation can lead to incorrect liquidation of users' positions a...

Reentrancy Vulnerability in MErc20Delegate.sol

Lines of code Vulnerability details Impact The fallback function delegates calls to the implementation contract using delegatecall. This allows the implementation contract to call back into MErc20Delegate before the original delegatecall completes. An attacker could exploit this vulnerability to...

THERE IS NO FUNCTIONALITY TO LIQUIDATE THE DEPRECATED MTOKEN MARKETS

Lines of code Vulnerability details Impact The Mtoken markets configured for the respective collateral asset types can get deprecated due to various reasons associated with those assets. There should be functionality in the Comptroller.liquidateBorrowAllowed function to liquidate all the borrows ...

Identifying publications using its ID makes the protocol vulnerable to blockchain re-orgs

Lines of code Vulnerability details Bug Description In the protocol, publications are uniquely identified through the publisher's profile ID and the publication's ID. For example, when a user calls act, the publication being acted on is determined by publicationActedProfileId and...

High - TemporalGovernor.sol - Malicious Governance Propsoals can interact with Metamorphic Contracts resulting in Business Critical Risk to the Protocol

Lines of code Vulnerability details High - TemporalGovernor.sol - Malicious Governance Propsoals can interact with Metamorphic Contracts resulting in Business Critical Risk to the Protocol Impact Due to the permisionless governance execution method, with no ascribed or implemented security...

the unbounded approve function allows a front-running vulnerability due to setting unlimited allowance.

Lines of code Vulnerability details Impact if approve is called with a very high allowance, the spender can drain the owner's entire balance. Proof of Concept approve allows setting an allowance to any arbitrary uint256 value, including typeuint.max. This effectively gives unlimited approval to t...

Nonces are not used in the signature checks

Lines of code Vulnerability details Impact A nonce can prevent an old value from being used when a new value exists. Without one, two transactions submitted in one order, can appear in a block in a different order Transactions on one identity can be replayed on another one. Proof of Concept...

[ H ] Infinite loop in calculateNewIndex prevents tokens from being minted and rewards from being distributed

Lines of code Vulnerability details Impact Recursive calls from calculateNewIndex in MultiRewardDistributor will result in an infinite loop and out of gas errors, preventing tokens from being minted and rewards being sent to some users as disburseSupplierRewardsInternal will not be called. Proof ...

Attacker can Steal all eths of WETHRouter.sol through redeem function

Lines of code Vulnerability details Impact An attacker can Steal eths through redeem function in WETHRouter.sol as you know the contract does the redeem process and redeem user mTokens to ETHs, and as you know we have the function of mint which is the opposite of this and users deposit ETH in ord...

Liquidator can seize more tokens than the borrower has as collateral, leading to an arithmetic underflow and locking collateral.

Lines of code Vulnerability details Impact Lack of validation on seizeTokens could allow collateral locking by underflow. Proof of Concept The liquidateBorrowFresh function does not explicitly validate that seizeTokens is less than or equal to accountTokensborrower before transferring tokens from...

Incorrect liquidity calculations if snapshot errors occur

Lines of code Vulnerability details Impact incorrect liquidity values that undermine the risk checks and constraints of the protocol Proof of Concept getHypotheticalAccountLiquidityInternal does not handle snapshot errors properly. Specifically: It calls MToken.getAccountSnapshot to get the...

The project's reputation and user funds can be affected if a clear invariant is not met

Lines of code Vulnerability details Vulnerability details Impact The protocol may not work as expected in years that are not 365 days long, which could lead to a loss of confidence in the protocol. In fact, the next year is one of those years leap year. Furthermore, defining it as a constant in t...

Migration of Profiles can fail due to existance of same handle

Lines of code Vulnerability details Impact Some profiles cannot be migrated to V2 if their handle tokenId has already been minted. Proof of Concept A handle can be minted in the LensHandles contract before a profile that would have the same handle is migrated from V1. When the profile attempts to...

lack of payable

Lines of code Vulnerability details Impact If it is not marked payable, the contract will throw an exception if it receives plain ether without data. Proof of Concept Tools Used Recommended Mitigation Steps fallback function should be payable Assessed type Payable --- The text was updated...

More collateral is seized than approved

Lines of code Vulnerability details Impact More collateral is seized outside of the comptroller's approved liquidation amount which means excess seizeTokens are transferred from the borrower to the liquidator leading to loss of funds Proof of Concept liquidateBorrowFresh first checks the allowanc...

Users positions can be directly liquidated when the admin changes the collateralFactorMantissa from a higher value to a lower value

Lines of code Vulnerability details Impact In Comptroller contract : Market.collateralFactorMantissa mltiplier represents the maximum underlying asset amount the depositors can borrow against their collateral in a market,for example:if it is set to 0.9;then 90% of collateral value is allowed to b...

Users cannot unfollow if they do not own the FollowNFT of the followTokenId used for their profile

Lines of code Vulnerability details Bug Description If the followTokenId of a profile is wrapped, users will only be able to unfollow if they are either: 1. The owner of the follow NFT. 2. An approved operator of the follow NFT's owner. This can be seen in the unfollow function of FollowNFT.sol:...

if _rescueFunds was called with the address of a mToken, the admin would currently be able to sweep those tokens,

Lines of code Vulnerability details Impact It allows the admin to steal deposited funds from users It removes mTokens used as collateral to back borrows Proof of Concept Assume there is a mToken at address 0x123 that has issued some tokens. The admin calls rescueFunds0x123, uint.max. This will...

The onlyProfileOwnerOrDelegatedExecutor and whenNotPaused checks can be bypassed

Lines of code Vulnerability details Impact The LensHub.sol functions setProfileMetadataURI, setProfileMetadataURIWithSig, setFollowModule, setFollowModuleWithSig, collect, collectWithSig, act, actWithSig, setProfileImageURI, setProfileImageURIWithSig and others use...

Missing check of how recent the price is can lead to stale price being used in the protocol

Lines of code Vulnerability details Impact In the ChainlinkOracle.sol file, in the function getChainlinkPriceAggregatorV3Interface feed, there is the check requireupdatedAt != 0, "Round is in incompleted state";. However, there is no check to see that the price is recent and acceptable. If there ...

Whitelisted profile creators could accidentally break migration for V1 profiles

Lines of code Vulnerability details Bug Description Profiles that exist before the V2 upgrade are migrated using the batchMigrateProfiles function, which works by minting the profile's handle and linking it to their profile: MigrationLib.solL69-L85 string memory handle =...

Due to revert found during testing it would be wise to implement a rollback and re-whitelist should it be needed

Lines of code Vulnerability details Impact During testing with the Mainnet fork for the migration testing. We needed to make a distinction between V1 Profiles and V2 profiles within the test code, but this is not so in the standard V2 code, and may cause unforeseen issues after the upgrade. The V...

Anyone can burn/steal other users' wrapped follow NFTs

Lines of code Vulnerability details Impact Anyone can unwrap any follow NFT Attackers can steal follows by burning them Owners lose their follows without consent Proof of Concept The lack of ownership check in the unwrap function creates a vulnerability where anyone can unwrap and steal a follow...

Signature malleability not protected against

Lines of code Vulnerability details Impact A signature should never be included into a signed message hash to check if previously messages have been processed by the contract. See reference: Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any othe...

The profileId is incremented using ++_profileCounter inside the createProfile function without any overflow checks in createProfile function

Lines of code Vulnerability details Impact If this issue exists, profileCounter reaches the maximum value, it will wrap around and reset to its minimum value, which is 0 for unsigned integers in Solidity. This unintended behavior can have several negative impacts on the functioning of the contrac...

profileIdAllowedToRecover is not handled properly in tryMigrate()

Lines of code Vulnerability details Impact In FollowNFT.sol, when calling tryMigrate, the state at the end should be the same when you call baseFollow and fresh follow the owner of the collection. However, profileIdAllowedToRecover is not handled inside of tryMigrate and it should be deleted as...

Anyone can permanently disable the token guardian for their wallet by calling this one DANGER__disableTokenGuardian function

Lines of code Vulnerability details Impact A hacker could call DANGERdisableTokenGuardian, instantly disable the guardian and steal tokens or make malicious approvals Proof of Concept The DANGERdisableTokenGuardian function is risky and should be reconsidered. The main issue is that it allows...

First mint user can inflate share which can steal asset from other user

Lines of code Vulnerability details Impact A well know inflation attack/first deposit mint bug. The attacker can steal assets from other user's deposit mint. Proof of Concept The Moonwell project is a fork from the Compound Protocol. The MToken the MToken on Compound represents a yield-bearing...

The processBlock() function does the wrapping process wrongly

Lines of code Vulnerability details Impact The blocking process in the FollowNFT contract needs to wrap it first, but it does the wrapping process wrongly. wrapping process in wrap function update some statement and then mint token but if you look at processBlock function, it's just mint token an...

initialize() function can manipulated by attacker

Lines of code Vulnerability details Impact initialize function in the FollowNFT.sol contract is external and everyone can call this function. comment in the code says: "This is called right after deployment by the LensHub, so we can skip the onlyHub check." But in this scenario, attacker can call...

Attackers might be able to avoid calling reference modules when creating publications

Lines of code Vulnerability details Bug Description When comment, mirror or quote is called on a publication with a reference module, the reference module will be called. For example, when a user mirrors another publication with a reference module, the processMirror function of that reference...

The FollowNFT.initialize() function will never be executed

Lines of code Vulnerability details Impact This function Initializes the follow NFT. To check if a function has already been initialized use: if initialized revert Errors.Initialized; This condition will always end with revert Errors.Initialized, because in the constructor, when expanding the...

tryMigrate() doesn't ensure that followerProfileId isn't already following

Lines of code Vulnerability details Bug Description In FollowNFT.sol, the tryMigrate function is used to migrate users who were following before the V2 upgrade. It does so by updating followTokenIdByFollowerProfileId and followDataByFollowTokenId, which are state variables introduced in the V2...

missing check for the max/min price in the chainlinkOracle.sol contract

Lines of code Vulnerability details Impact the chainlinkOracle.sol contract specially the getChainlinkPrice function using the aggregator v2 and v3 to get/call the latestRoundData. the function should check for the min and max amount return to prevent some case happen, something like this: if cas...

Privacy Violation: Unauthorized Access to Blocking Status of Profiles

Lines of code Vulnerability details Impact The smart contract contains a critical privacy violation that allows unauthorized users to access the blocking status of profiles. The isBlocked function, which is intended to check if one profile is blocked by another, lacks proper access controls and...

Missing owner check on from when transferring tokens

Lines of code Vulnerability details Impact The LensBaseERC721.transferFrom/safeTransferFrom/burn they check approvals on msg.sender through isApprovedOrOwnermsg.sender, tokenId, it is never checked that the specified from parameter is actually the owner of the NFT. An attacker can decrease other...

Front-Running Vulnerability in LensHub.sol's commentWithSig and quoteWithSig Functions

Lines of code Vulnerability details Impact A vulnerability has been discovered in LensHub.sol's commentWithSig and quoteWithSig functions. This vulnerability potentially enables an attacker to disrupt users' actions by front-running transactions, resulting in undesirable modifications of comments...

Inability of Followers and Followees to Commenting

Lines of code Vulnerability details Impact The lack of functionality restricts interaction and engagement between the profile owner and their followers or the users they follow. This limitation diminishes the platform's value, as users who are interested in a post or have a genuine reason to...

wrap after unfollow is enabled

Lines of code Vulnerability details Impact wrap after unfollownft is enabled , cause many problems Proof of Concept by design, wrap after unfollowed is not allowed,but it seems that it's possible due to lack of limitation. poc below: add below script in FollowNFTTest.t.sol //forge test --match-te...

Unauthorized Profile "Follow" Operation Bug

Lines of code Vulnerability details Description The contract's followWithSig function allows any user with a valid signature to execute "follow" operations on behalf of any profile without properly verifying the ownership of the profile or checking if the signer is an approved executor. This bug...

Function initialize Not Work

Lines of code Vulnerability details Impact As mentioned in the comment of the function initialize, "This is called right after deployment by the LensHub, so we can skip the onlyHub check". However, when the contract FollowNFT is deployed, the state variable initialized is set to true in the...

tryMigrate() has onlyHub modifier but it's called from LensV2Migration

Lines of code Vulnerability details Impact In FollowNFT.sol, tryMigrate function has onlyHub modifier as other functions that are supposed to be called by LensHub such as follow and unfollow. These functions are called via delegatecall and LensHub is preserved as msg.sender. The problem is that t...

Lack of Preventing Multiple Follows to the Same Profile ID

Lines of code Vulnerability details Impact The absence of a check for multiple follows to the same profile ID poses a significant security and integrity risk for the smart contract. By exploiting this vulnerability, a malicious user could inflate the number of followers for a particular profile I...

Unchecked Call Return Value of ERC20 Functions

Lines of code Vulnerability details Impact The return value of 'transfer' and 'transferFrom' should be verified since these two functions may only return false but not cause execution reverted once fail. If not properly handled, it might incur asset losses to users and the project party. Tools Us...

Unauthenticated Access of withdrawToTreasury Makes _distributeFees Not Work

Lines of code Vulnerability details Impact Since the function withdrawToTreasury lacks authority control, anyone can call withdrawToTreasury to transfer erc20 token or native coin held by the contract to the treasury. This will indirectly cause the transaction which calls function...

Incorrect Signature Validation in LensHub Contract

Lines of code Vulnerability details Description The LensHub contract contains two functions, "setFollowModuleWithSig" and "setProfileImageURIWithSig," that allow users to set a follow module and profile image URI, respectively, for a profile using EIP712 signatures for verification. However, the...

A user could call mint() with less ETH than the mintPrice and improperly mint badges for a cheaper cost.

Lines of code Vulnerability details Impact users underpaying to mint badges will lead to loss of funds Proof of Concept It checks if msg.value is less than the required mintPrice, but it does not check for the case where msg.value mintPrice. This means: A user could send only 1 wei when the...

Incorrect accounting in GSC approval mechanism in ArcadeTreasury

Lines of code Vulnerability details Impact Once the GSC has approved a spender for a certain amount of tokens, any further attempt to modify this approval will result in inaccessible treasury funds. Proof of Concept Currently every call to gscApprove results in the gscAllowance decreasing which...

withdrawFees Have a vulnerability leading to

Lines of code Vulnerability details Impact Thé withdrawFees function allows the manager to withdraw all ETH fees from the contract., this function uses the transfer method here the vulnerable part: function withdrawFeesaddress recipient external onlyRoleBADGEMANAGERROLE if recipient == address0...