10190 matches found
Function trigering
Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The redeemPayment funtion does not check if the payment token being transferred to the delegation terms contract is approved by the sender. This can allow an attacker to call this function and transfer...
A staker with verified over-commitment can potentially bypass slashing completely
Lines of code Vulnerability details Description In EigenLayer, watchers submit over-commitment proof in the event a staker's balance on the Beacon chain falls below the minimum restaked amount per validator. In such a scenario, stakers’ shares are decreased by the restaked amount. Note that when ...
Upgraded Q -> 3 from #306 [1683219251927]
Judge has assessed an item in Issue 306 as 3 risk. The relevant finding follows: L-01 Consider using OpenZeppelin’s SafeCast library to prevent unexpected overflows when casting from uint256 In the function buy and sell of the contract PrivatePool.sol the function first set the variables...
Staker can avoid ETH slash by front run slashQueuedWithdrawal() with completeQueuedWithdrawal()
Lines of code Vulnerability details Impact Malicious staker can avoid the service's slash on its restaked ETH shares. Proof of Concept This issue is similar to Staker can avoid ETH slash by front run slashShares with verifyOvercommittedStake, but with a different logic. When a service/middleware...
MAX_WITHDRAWAL_DELAY_BLOCKS assumes that block time is always 12 seconds
Lines of code Vulnerability details Impact Block time may change in the future which may affect the protocol's withdrawal functionality. Proof of Concept StrategyManagerStorage.sol assumes a 12-second blocks timing. If the block time changes in the future the MAXWITHDRAWALDELAYBLOCKS of one week...
freezeOperator will not be able to freeze an operator
Lines of code Vulnerability details Impact freezeOperator will not be able to freeze an operator address in blockchain reorg situation Proof of Concept canSlash function is relying on block.number as it should be lower than contractCanSlashOperatorUntilBlock. that will work fine until a reorg on...
[M-1] Potential DoS attack due to unchecked array lengths in loop
Lines of code Vulnerability details M-1 Potential DoS attack due to unchecked array lengths in loop Impact If strategies and shares have different lengths and the code uses them in a loop without checking their lengths, it could potentially cause an out-of-bounds error, which could lead to a...
Manipulation Compromised proposal processing claimDelayedWithdrawals
Lines of code Vulnerability details Impact By exploiting legitimate users' access to claim delayed withdrawals, an attacker could potentially drain a sizable portion of the contract's funds before detection. Manipulative access to critical system functions poses a substantial financial risk. Proo...
High gas consumption vulnerability due to high merkle tree heights
Lines of code Vulnerability details Impact The issue stems from the utilization of tall trees in numerous merkle trees within the BeaconChainProofs library. This could lead to considerable gas consumption during the creation and verification of such trees. The consequence of this vulnerability is...
Integer Overflow in Endian Library
Lines of code Vulnerability details Impact An integer overflow can lead to unexpected behavior in a smart contract, potentially causing financial loss or disruption of the contract's intended functionality. Proof of Concept If the input value passed to the function exceeds 64 bits, an integer...
Measuring the withdrawal delay in block production time won't work properly on chains where the production time is not 12 seconds
Lines of code Vulnerability details Proof of Concept For withdrawals other than beaconChainETH, the variables withdrawalDelayBlocks and MAXWITHDRAWALDELAYBLOCKS will be used to enforce a delay for withdrawals in StrategyManager.sol. Currently MAXWITHDRAWALDELAYBLOCKS is set to 50400. uint256 publ...
Vulnerability in Pause Function
Lines of code Vulnerability details Impact An attacker can exploit this vulnerability by setting any value as the new paused status code, which can allow the attacker to circumvent the pausing restrictions and carry out unauthorized actions on the contract. This can lead to significant consequenc...
isContract() is not a reliable way of checking if the input is an EOA
Lines of code Vulnerability details Impact depositIntoStrategyWithSignature is checking if the msg.sender is EOA or the contract and it is doing it by check isContract which is not right Proof of Concept The isContract check can be passed even though if msg.sender is a smart contract if Function ...
Staker can bypass the debt accrued via beaconChainETHSharesToDecrementOnWithdrawal by transferring shares to another address
Lines of code Vulnerability details Description When a staker is verified to have over-committed and the over-committed amount is greater than their outstanding shares, they accrue a debt that is captured by beaconChainETHSharesToDecrementOnWithdrawal. This debt eventually gets settled when the...
Depositors risk losing funds through StrategyManager.depositIntoStrategyWithSignature()
Lines of code Vulnerability details Impact The StrategyManager contract has two functions for depositing funds into Strategy contracts, one of them is depositIntoStrategyWithSignature which allows the caller to make a deposit and the new shares are credited to a specified staker. If the staker...
Upgraded Q -> 3 from #891 [1683219170863]
Judge has assessed an item in Issue 891 as 3 risk. The relevant finding follows: L-1: Unsafe casting may overflow Context: virtualBaseTokenReserves += uint128netInputAmount - feeAmount - protocolFeeAmount; L230 virtualNftReserves -= uint128weightSum; L231 virtualBaseTokenReserves -=...
Upgraded Q -> 2 from #898 [1683143849953]
Judge has assessed an item in Issue 898 as 2 risk. The relevant finding follows: Royalty receiver will not get correct royalty as saleprice is not calculated properly uint256 salePrice = outputAmount / sellsi.tokenIds.length; Here the salesprice for an nft is calculated by using the above formula...
Upgraded Q -> 2 from #200 [1683080702977]
Judge has assessed an item in Issue 200 as 2 risk. The relevant finding follows: L-03 KangarooVaultminDepositAmount should be a fairly high number to prevent 0 deposits or dust deposits that may affect the deposit/withdrawal process --- The text was updated successfully, but these errors were...
Upgraded Q -> 2 from #225 [1683100933057]
Judge has assessed an item in Issue 225 as 2 risk. The relevant finding follows: uint256 exponent = baseToken == address0 ? 18 - 4 : ERC20baseToken.decimals - 4; will revert since ERC20baseToken.decimals - 4; causes an underflow --- The text was updated successfully, but these errors were...
Updating a submission - testing is i can add a submission by team that was originally an issue for a single warden.
Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps testings...
Upgraded Q -> 3 from #407 [1683102761347]
Judge has assessed an item in Issue 407 as 3 risk. The relevant finding follows: L01 Unsafe downcasting On PrivatePool.solL230-L231 there are two unsafe downcasting from uint256 to uint128; virtualBaseTokenReserves += uint128netInputAmount - feeAmount - protocolFeeAmount; virtualNftReserves -=...
Upgraded Q -> 2 from #198 [1683053533286]
Judge has assessed an item in Issue 198 as 2 risk. The relevant finding follows: L2 - Royalty payment is unfair --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #543 [1683017069535]
Judge has assessed an item in Issue 543 as 2 risk. The relevant finding follows: changeFeeQuote assumes all base tokens will be of decimals of at 4 decimals. However this would lead to issues whereby baseToken is of 2 decimal place. --- The text was updated successfully, but these errors were...
Upgraded Q -> 2 from #878 [1683053122687]
Judge has assessed an item in Issue 878 as 2 risk. The relevant finding follows: L-2 Royalties are paid assuming all NFTs in the batch are equally priced - --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #215 [1683053585771]
Judge has assessed an item in Issue 215 as 2 risk. The relevant finding follows: QA10 Both EthRouterbuy and EthRoutersell do not check whether recipient == address0, as a result, they might send royalty fees to the zero address - loss of funds. --- The text was updated successfully, but these...
Upgraded Q -> 3 from #284 [1683017290576]
Judge has assessed an item in Issue 284 as 3 risk. The relevant finding follows: NFT tokens sent to the EthRouter contract by mistake can be drained by pool contracts. When someone calls sell, deposit or change functions on EthRouter contract, the contract gives the particular pool full approval...
Upgraded Q -> 2 from #878 [1683053128185]
Judge has assessed an item in Issue 878 as 2 risk. The relevant finding follows: L-3 Potential loss of funds when paying royalties - --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #740 [1683013961460]
Judge has assessed an item in Issue 740 as 2 risk. The relevant finding follows: Royalty receiver can reject, unsupported, or be blacklisted to receive royalty fee token and can result in the whole transaction be reverted. --- The text was updated successfully, but these errors were encountered:...
Upgraded Q -> 2 from #245 [1683017351880]
Judge has assessed an item in Issue 245 as 2 risk. The relevant finding follows: L-05 PrivatePoolMetadata.tokenURI is not compliant with EIP721 It implements PrivatePoolMetadata.tokenURI , a function overriding ERC721's tokenURI. This function returns the metadata URI of the provided token ID The...
Upgraded Q -> 2 from #680 [1683016840166]
Judge has assessed an item in Issue 680 as 2 risk. The relevant finding follows: A. Fee structure is inconsistent for buys/changes. In buy and sell function protocolFee is based on a percentage of the input/output amount but in change the fee is based on the pool fee not the input amount. It shou...
Upgraded Q -> 2 from #198 [1683053528122]
Judge has assessed an item in Issue 198 as 2 risk. The relevant finding follows: L1 - The pool takes more royalty fee than it spends --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #680 [1683016846473]
Judge has assessed an item in Issue 680 as 2 risk. The relevant finding follows: D. FlashFee is a flat amount, meaning the cost to flash loan an NFT at floor price is the same as one worth 5x the floor price. FlashFee should instead be based on the weigh of the NFT being flashloaned, with more...
Upgraded Q -> 3 from #222 [1683017474019]
Judge has assessed an item in Issue 222 as 3 risk. The relevant finding follows: L-02 Downcasting uint or int may result in overflow Consider using OpenZeppelin's SafeCast library to prevent unexpected overflows. Instances: 2 File: src/PrivatePool.sol 231: virtualNftReserves -= uint128weightSum;...
Upgraded Q -> 3 from #878 [1683053134023]
Judge has assessed an item in Issue 878 as 3 risk. The relevant finding follows: L-7 Potential overflow while updating reserves values in PrivatePool contract - --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #878 [1683053139232]
Judge has assessed an item in Issue 878 as 2 risk. The relevant finding follows: L-8 Zero amount ERC20 token transfers may fail some implementations - --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #882 [1683052810426]
Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: Attacker can front-run create to steal tokens sent to predetermined address --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #882 [1683052827510]
Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: changeFeeQuote reverts for tokens with decimals less than 4 --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #240 [1683052133668]
Judge has assessed an item in Issue 240 as 2 risk. The relevant finding follows: LOW‑11 tokenURI does not follow EIP-721 The EIP states that tokenURI "Throws if tokenId is not a valid NFT", which the code below does not do. If the NFT has not yet been minted, tokenURI should revert Proof Of Conce...
Upgraded Q -> 2 from #882 [1683052821779]
Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: In function buy and sell if one royalty recipients reverts whole transaction will fail --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #854 [1683053410661]
Judge has assessed an item in Issue 854 as 2 risk. The relevant finding follows: L-01 Reorg attack possibility in pool factory 1 --- The text was updated successfully, but these errors were encountered: All reactions...
Testing Issue Type
Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps testing...
Upgraded Q -> 2 from #882 [1683052832814]
Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: In changeFeeQuote if changeFee == 0 protocolFeeAmount becomes 0 --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #882 [1683052816154]
Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: If royaltyFee 0 and recipient == address0 users will be overcharged --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> 2 from #854 [1683053416481]
Judge has assessed an item in Issue 854 as 2 risk. The relevant finding follows: L-07 Malicious collection owner could steal all base tokens by updating royalty during calls 1 --- The text was updated successfully, but these errors were encountered: All reactions...
Improper Implementation of Interface
Lines of code Vulnerability details Impact The improper implementation of interfaces can cause unexpected behavior in the contract and lead to an unwanted state of the contract. This can potentially affect several functions. Description The DNSSECImpl contract contains two internal functions,...
DNS wire format AND DNS label-sequence format ARE USED INTERCHANGABLY TO REPRESENT DOMAIN NAMES DURING RRSet VALIDATION
Lines of code Vulnerability details Impact @param name The name to claim, in DNS wire format. above format is used in DNSRegistrar.proveAndClaim and DNSRegistrar.proveAndClaimWithResolver functions @param name The name of the RRSIG record, in DNS label-sequence format. above format is used in...
If a label for a domain gets locked once, the domain will never be able to be claimed in DNSRegistrar.sol, since there's no method to unlock a label
Lines of code Vulnerability details Proof of Concept When claiming a domain in DNSRegistrar.sol either through proveAndClaim or proveAndClaimWithResolver, the internal function enableNode will be called. The snippet bellow shows that when owner == address0 or owner == previousRegistrar and...
Upgraded Q -> 2 from #763 [1682682097179]
Judge has assessed an item in Issue 763 as 2 risk. The relevant finding follows: In line 87 there's a check for a pause setting. If staking is currently paused, the operation will fail. Similar to the edge case described above, line 88 verifies that msg.value != 0. The division in the weighted...
Unbounded Loop in DNS Name Encoder Library
Lines of code Vulnerability details Impact The unchecked keyword disables overflow and underflow checks for arithmetic operations, which can cause unexpected behavior if the loop is not properly bounded. In this specific case, the loop is not properly bounded, which can cause the loop to run...