It is not possible to create or execute new extraordinary proposals after 10 funded Extraordinary Proposals

Lines of code Vulnerability details Impact With each executed offer, the value of getMinimumThresholdPercentage increases, resulting in the fact that when trying to create a new proposal or execute existing, getMinimumThresholdPercentage exceeds 1e18 and we catch an underflow error via...

Attacker can DoS create a extraordinary proposals

Lines of code Vulnerability details Impact An attacker can prevent the creation of proposals in ExtraordinaryFunding.solproposeExtraordinary by front-running the proposal, which will give him the same hash as the correct user desired, and setting endBlock to the past, which will invalidate the...

stake() function: The provided stake function lacks checks to prevent a lender from staking multiple NFTs in the same Ajna pool. The function allows any owned position NFT to be staked without considering whether the lender has already staked in the pool. This potentially opens up the system to an abuse where a lender stakes multiple NFTs for the same liquidity position.

Lines of code Vulnerability details Impact The current stake function lacks checks to prevent a lender from staking multiple NFTs in the same Ajna pool. This could lead to an abuse of the system where a lender stakes multiple NFTs for the same liquidity position, potentially earning more rewards...

Race condition vulnerability in positionManager minting function

Lines of code Vulnerability details Impact race condition vulnerability can result in the issuance of duplicate token IDs. When multiple transactions are executed in quick succession attempting to mint tokens, they may end up being assigned the same ID due to a shared counter or variable used to...

Insufficient Validation of Total Tokens Requested.

Lines of code Vulnerability details Impact In the proposeExtraordinary function in the Funding contract. Specifically, in the following line: L105 if uint256totalTokensRequested getSliceOfTreasuryMaths.WAD - getMinimumThresholdPercentage revert InvalidProposal; If the totalTokensRequested paramet...

Standard voting favors proposals which ask for lower GBC

Lines of code Vulnerability details Impact Proposals which ask for higher % of the GBC have a serious disadvantage. Proof of Concept For simplicity, let's say there are only 3 projects in the screening stage. Project A asks for 90% GBC and projects B and C ask for 40% GBC each. Therefore, project...

The design flaws have resulted in unfairness in the protocol.

Lines of code Vulnerability details Impact Ordinary traders are not aware that the contract does not have sufficient ajna tokens when receiving rewards, resulting in partial loss of ajna. Smart traders will check the contract token balance before claiming rewards, which leads to unfairness. Proof...

There can be a maximum of 11 proposals

Lines of code Vulnerability details Impact Overflow Proof of Concept The proposeExtraordinary function restricts that the result of the getMinimumThresholdPercentage function must be less than or equal to 1018. The maximum length of the fundedExtraordinaryProposals array is 10, but there is no...

unstake() function: The unstake function permits the unstaking of multiple position NFTs from the same liquidity pool (LP) by the same lender. This opens the possibility for a lender to claim more Ajna token rewards than they are entitled to by staking and unstaking multiple NFTs associated with the same LP.

Lines of code Vulnerability details Impact The absence of a mechanism to prevent a lender from unstaking multiple NFTs for the same liquidity pool LP could potentially lead to the exploitation of the Ajna token reward system. A lender can mint, stake, and unstake multiple NFTs for the same LP fro...

Unchecked increment in calculateRewards function of RewardsManager.sol.

Lines of code Vulnerability details Impact In the calculateRewards function, there is an unchecked increment in the for loop, in the code it can allow an attacker to cause an integer overflow in the calculateRewards function by manipulating the loop variable, resulting in incorrect rewards...

Proposed Token Request Exceeds Available Funds Check Missing.

Lines of code Vulnerability details Impact The proposeStandard function in StandardFunding.sol contract does not include a direct check to ensure that the proposed tokens requested are less than or equal to the actual available funds for the distribution period. Instead, it only checks if the...

Inconsistence input of depositTime might lead to unexpected result

Lines of code Vulnerability details Impact Inconsistency by relying on depositTime at positions hashmap instead of reading the value from lenderInfo Proof of Concept The depositTime is being read from fromPosition.depositTime at moveLiquidity function and not from lenderInfo L268 and L285...

Integer Overflow in executeExtraordinary Function.

Lines of code Vulnerability details Impact The executeExtraordinary function casts a uint128 value to a uint256 value, which could lead to an integer overflow vulnerability. An attacker can provide a large uint128 value that exceeds the maximum value for uint256, causing the value to overflow and...

Use of msg.sender in mayInteract Modifier

Lines of code Vulnerability details Impact The use of msg.sender in the mayInteract modifier in the contract. I have identified a potential vulnerability in the use of msg.sender. In this case, the vulnerability is caused by using msg.sender to authorize interactions with the contract. Since...

Incorrect calculation of the remaining updatedRewards leads to possible underflow error

Lines of code Vulnerability details Impact RewardsManage.sol keeps track of the total number of rewards collected per epoch for all pools: File: 2023-05-ajna\ajna-core\src\RewardsManager.sol 73: /// @dev epoch = rewards claimed mapping. 74: mappinguint256 = uint256 public override rewardsClaimed;...

Lack of Access Control in claimRewards Function

Lines of code Vulnerability details Impact The calculateNewRewards function should also check whether the rewardsCapped variable is greater than the rewardsClaimedInEpoch variable to ensure that rewards are not claimed that exceed the reward cap, because an attacker could exploit this vulnerabili...

_transferAjnaRewards doesn't save the remaining rewards of a staker for the next transfer

Lines of code Vulnerability details Impact Staker will earn less than expected Proof of Concept On claimRewards function at transferAjnaRewards is being called to claim rewardsEarned for staker according to the tokenId, the issue here drop at if rewardsEarned ajnaBalance rewardsEarned =...

Upgraded Q -> 2 from #279 [1683710498041]

Judge has assessed an item in Issue 279 as 2 risk. The relevant finding follows: L-06 EllipticCurve.validateSignature has wrong and needless code blocks if P2 == 0 return false; uint256 Px = inverseModP2, p; Px = mulmodP0, mulmodPx, Px, p, p; Px = p0 inverseP2^2 is not correct here. Fortunately, ...

Upgraded Q -> 2 from #49 [1683711080406]

Judge has assessed an item in Issue 49 as 2 risk. The relevant finding follows: QA10. readKeyValue fails to enforce the constraint offset+len Mitigation: make sure offset+len input.length revert outOfBoundAccess; uint256 separator = input.findoffset, len, "="; if separator == typeuint256.max retu...

Upgraded Q -> 2 from #298 [1683710120837]

Judge has assessed an item in Issue 298 as 2 risk. The relevant finding follows: L-03 Redundant and dangerous len parameter in readKeyValue Links Impact If the len is not set to input.length minus the offset, there may be unpredictable results due how the algorithm works. Proof of Concept Let's...

Upgraded Q -> 2 from #49 [1683711003164]

Judge has assessed an item in Issue 49 as 2 risk. The relevant finding follows: QA9. hexStringToBytes32 fails to check that range idx, lastIdx is within 32 bytes range and thus the returned r will fit into bytes32. Mitigation: Introduce the check: function hexStringToBytes32 bytes memory str,...

Upgraded Q -> 2 from #298 [1683709930306]

Judge has assessed an item in Issue 298 as 2 risk. The relevant finding follows: L-01 Valid hex string is not decoded correctly by hexStringToBytes32 and reads memory out-of-boundary Links Impact Valid hexadecimal strings are not decoded correctly. Decoding reads out-of-bounds memory returning...

Test Submission

Lines of code Vulnerability details Test issue content Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute...

Upgraded Q -> 2 from #99 [1683646958313]

Judge has assessed an item in Issue 99 as 2 risk. The relevant finding follows: 03 ALLOWING ShortCollateral.refresh FUNCTION TO BE CALLABLE BY ANYONE CAN BE DANGEROUS --- The text was updated successfully, but these errors were encountered: All reactions...

high risk issue

Lines of code Vulnerability details Submitting a high risk issue! Assessed type ERC4626 --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-12: Issue NOT mitigated

Mitigated issue M-12: No slippage protection on stake in SafEth.sol There were issues with either a lack of slippage protection or a hard set slippage. Slippage protection was missing in deposit for Reth.deposit only if depositing in the Rocket Pool and in Reth.withdraw, as well as in stake becau...

Mitigation of M-06: See comments

Mitigation of M-06: See comments Link to Issue: code-423n4/2023-03-asymmetry-findings770 Comments Sponsor decided not to mitigate the issue with the following comment: This is as expected I agree that the issue is TOO broad and some of the described scenarios don't make sense at all e.g. the...

Mitigation Confirmed for M-01

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-01: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings1078 Comments While the "division before multiplication" issues described in M-01 have been mitigated in the proposed changeset, there are other case...

Mitigation of M-04: Mitigation error

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-04: Mitigation error Link to Issue: code-423n4/2023-03-asymmetry-findings932 Comments Even though the original issue is mitigated, as the exchange through Uniswap V3 has been completely removed in favor of using...

Mitigation Confirmed for Mitigation of M-10: Issue mitigated

Mitigated issue M-10: Stuck ether when use function stake with empty derivativesderivativeCount = 0 The issue was that stake will accept payment but not issue safETH when derivativeCount == 0 or when all weightsi == 0. Mitigation review The proposed mitigation simply adds a requirederivativeCount...

Mitigation Confirmed for H-06

Fix looks good. Root issue was assume 1:1 peg for stETH. This has been fixed by getting true price of stETH from chainlink oracle. --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-11: Issue NOT mitigated

Mitigated issue M-11: Residual ETH unreachable and unuitilized in SafEth.sol The issue was that the rounding losses from partitioning msg.value in stake and rebalanceToWeights was left irretrievably in the contract. Mitigation review Previously rebalanceToWeights withdrew all staked funds and...

Reappearance of M-02 in SafEth.unstake()

Reappearance of M-02 in SafEth.unstake Description The changes in SafEth.unstake has introduced a new issue parallel to the one present in SfrxEth.withdraw which was reported in M-02: sFrxEth may revert on redeeming non-zero amount, i.e. SafEth.unstake may revert as a consequence of a valid call ...

Rounding loss in and with approxPrice()

Rounding loss in and with approxPrice Description SafEth.approxPrice contains a rounding loss of the form a/k + b/k = ac/b. We would...

Mitigation Confirmed for NEW

H-02, H-05, H-06, H-08 mitigation error: No sanity check on Chainlink price feed Description and recommendation The mitigation of issues H-02, H-05, H06 and H-08 have introduced a Chainlink price feed. In all of those instances there are no sanity checks on the Chainlink return data, especially...

Chainlink price feed responses are not validated

NEW ISSUE - MITIGATION IS NOT CONFIRMED NEW ISSUE - MITIGATION IS NOT CONFIRMED adriro-NEW-H-02 Chainlink price feed responses are not validated Link to changesets: Impact The protocol team introduced Chainlink price feeds for the Reth and WstEth derivatives in order to mitigate price manipulatio...

Mitigation of M-08: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-08: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings685 Comments First, there is a clear error in the associated description of mitigation: "Use Chainlink to get rETH". Using Chainlink to obtain the...

Mitigation of M-12: mitigation error, see comments

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-12: mitigation error, see comments Link to Issue: code-423n4/2023-03-asymmetry-findings150 Comments While the proposed change correctly mitigates the issue, in the sense that it introduces a user controlled slippage for stake...

Mitigation of M-07: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-07: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings765 Comments While the principal issue for M-07 described a de-peg scenario, which eventually was interpreted as a "black swan" event, I do think the...

Mitigation of M-10: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-10: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings363 Comments Even though the protocol team applied the warden's recommendation in M-10, the feature to enable/disable derivatives added as a mitigati...

Mitigation Confirmed for NEW

Note: Issue has not actually been resolved but for some reason I can't get my issues to submit without "Mitigation confirmed no new vulnerabilities detected" checked so I am doing this as a work around Severity High Lines of code Impact Derivative will become broken and all funds lost even if the...

Reappearance of M-02 in WstEth.withdraw()

Reappearance of M-02 in WstEth.withdraw Description The changes in WstEth.withdraw has introduced a new issue exactly parallel to the one present in SfrxEth.withdraw which was reported in M-02: sFrxEth may revert on redeeming non-zero amount, i.e. WstEth.withdrawamount may revert when amount 0. F...

Mitigation of M-05: Issue not mitigated, mitigation errors

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-05: Issue not mitigated, mitigation errors Link to Issue: code-423n4/2023-03-asymmetry-findings812 Comments The issue describes missing checks associated with staking requirements for the WstEth and Reth derivative. The...

Mitigation Confirmed for Mitigation of M-05: See comments

Mitigated issue M-05: Missing derivative limit and deposit availability checks will revert the whole stake function The issue was that stake calls deposit on each derivative without considering certain conditions under which some deposit might revert. There is an overlap between this issue and...

Mitigation of M-11: Issue not mitigated, mitigation error

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-11: Issue not mitigated, mitigation error Link to Issue: code-423n4/2023-03-asymmetry-findings152 Comments Even though the sponsor followed the warden's recommendation in issue M-11, I don't think the proposed change properly...

Mitigation of M-09: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-09: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings673 Even though the contest repository revision 431a4b751fb7e184b847a41509b97e4d67971d2f doesn't mention a changeset for M-09, I assume the...

Hard slippage in Reth.withdraw()

Hard slippage in Reth.withdraw Description A hard slippage has been introduced in Reth.withdraw. This is a new occurrence of part of M-12 not the main report, but e.g. this duplicate, namely that the slippage can be changed only by the owner, which under volatile market conditions or a depegging...

Protocol assumes a 1:1 peg of frxETH to ETH

NEW ISSUE - MITIGATION IS NOT CONFIRMED NEW ISSUE - MITIGATION IS NOT CONFIRMED adriro-NEW-H-01 Protocol assumes a 1:1 peg of frxETH to ETH Link to changeset: Impact The ethPerDerivative function in the SfrxEth now assumes a peg of frxETH to ETH, and reverts if the price difference queried throug...

Mitigation of M-08: Issue NOT mitigated

Mitigated issue M-08: Possible DoS on unstake The issue is that a potential time-lock in Rocket Pool may cause RocketTokenRETHInterfacerethAddress.burnamount to revert, which prevents frequent withdrawals and unstakes. Mitigation review Reth.withdraw still calls...

Mitigation of M-02: Issue perhaps NOT sufficiently mitigated

Mitigation of M-02: Issue perhaps NOT sufficiently mitigated Mitigated issue M-02: sFrxEth may revert on redeeming non-zero amount The issue was that SfrxEth.withdrawamount may revert when called in unstake, blocking unstaking, if amount is low most realistically if amount == 1. Mitigation review...