Config update happening in memory instead of at storage slot

Lines of code Vulnerability details Impact While adding configs in addConfig function, configs is updated in memory as shown at . It should accept configs parameter to a function as storage. Proof of Concept function addConfiguint256 memory configs, uint256 configsLen, DripsReceiver memory receiv...

Immutable varibles should be checked to there default values

Lines of code Vulnerability details Impact It is very important to check whether the immutable variables are not equal to the default values because if Quest is created and when we pass a default value to a variable then it can't be changed and it can lead to a problem. Proof of Concept Suppose...

mintReceipt could mint receipt after endtime.

Lines of code Vulnerability details Impact mintReceipt could mint receipt after endtime. If owner execute withdrawRemainingTokens user’s receipt that mint after endtime can’t claim. Proof of Concept function withdrawRemainingTokensaddress to public override onlyOwner...

Bad implementation in minter access control for RabbitHoleReceipt and RabbitHoleTickets contracts

Lines of code Vulnerability details Both RabbitHoleReceipt and RabbitHoleTickets contracts define a mint function that is protected by a onlyMinter modifier: RabbitHoleReceipt: function mintaddress to, string memory questId public onlyMinter tokenIds.increment; uint newTokenID = tokenIds.current;...

The onlyMinter modifier checks the wrong condition.

Lines of code Vulnerability details Impact In RabbitHoleReceipt.sol and RabbitHoleTicket.sol, receipts and tickets can be minted by anyone. Proof of Concept The first line inside the modifier can be passed without reverting for any callers. modifier onlyMinter msg.sender == minterAddress; ; Tools...

Mitigation of H-05: Issue not mitigated

Lines of code Vulnerability details Mitigation of H-05: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

Attacker can steal the NFT bought by sending it to another vault he control

Lines of code Vulnerability details Impact The mitigation of H-08 try to validate the vault returned by market with the VaultRegistry. However, it only validated if the vault exists, but not if it is the correct vault. A similar attack described in code-423n4/2022-12-tessera-findings47 can be...

Mitigation of M-06: Issue not mitigated

Lines of code Vulnerability details The sponsor disputes the issue, but never follows up after judge's comments, so the same issue remains in the new code. --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of H-05: Issue not mitigated

Lines of code Vulnerability details The sponsor confirmed the issue, but did not provide any PRs addressing it, so the same issue remains in the new code. --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-01: Issue not mitigated

Lines of code Vulnerability details Mitigation of M-01: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-05: Issue not mitigated

Lines of code Vulnerability details Mitigation of M-05: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-04: See comments

Lines of code Vulnerability details The PR does NOT fix the issue described in the finding, and instead addresses issue 45. The change breaks out of the loop, which solves the case where the price is the same as the lowest bid, but doesn't address the case where the price is higher than the lowes...

Mitigation of M-07: Issue not mitigated

Lines of code Vulnerability details Mitigation of M-07: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-07: Issue not mitigated

Lines of code Vulnerability details The sponsor confirmed but disputed Medium severity, and did not provide any PRs addressing it, so the same issue remains in the new code. --- The text was updated successfully, but these errors were encountered: All reactions...

Integer Overflow Vulnerability in _addSplittable Function.

Lines of code Vulnerability details Impact splitsStorage.splitsStatesuserId.balancesassetId.splittable += amt; This vulnerability, if exploited, would allow an attacker to add a large amount of funds to a user's splittable balance, causing it to exceed the maximum value that the uint128 type can...

Mitigation of M-02: Issue not mitigated

Lines of code Vulnerability details The sponsor appears to confirm Medium severity, but did not provide any PRs addressing it, so the same issue remains in the new code. --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-02: Issue not mitigated

Lines of code Vulnerability details Mitigation of M-02: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-01: Issue not mitigated

Lines of code Vulnerability details The sponsor appears to confirm with no-fix and did not provide any PRs addressing it, so the same issue remains in the new code. --- The text was updated successfully, but these errors were encountered: All reactions...

Incorrect calculation

Lines of code Vulnerability details Impact On line 119, the result of the conversion is always going to be zero. Therefore, functions that apply onlyDriver modifier will never be executed. Proof of Concept Please deploy the code below to test the modifier's broken implementation. //...

Mitigation of M-05: Issue not mitigated

Lines of code Vulnerability details The sponsor disputes the issue, but never follows up after judge's comments, so the same issue remains in the new code. --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of M-03: See comments

Lines of code Vulnerability details The PR does not follow the recommended mitigation from the finding, and instead still allows under-priced bids to be added if the total value being added is at least a multiple of the minimum reserve price. Impact If, for example, the reserve price is 10 Eth,...

Lack of flexibility in updating cycle length leading to potential contract redeployment.

Lines of code Vulnerability details Impact function cycleOfuint32 timestamp private view returns uint32 cycle unchecked return timestamp / cycleSecs + 1; and function currCycleStart private view returns uint32 timestamp uint32 currTimestamp = currTimestamp; // slither-disable-next-line weak-prng...

Incorrect calculation

Lines of code Vulnerability details Impact On line 119, the result of the conversion is always going to be zero. Therefore, functions that apply onlyDriver modifier will never be executed. Proof of Concept Please deploy the code below to test the modifier's broken implementation. //...

Mitigation of M-06: Issue not mitigated

Lines of code Vulnerability details Mitigation of M-06: Issue not mitigated --- The text was updated successfully, but these errors were encountered: All reactions...

Mitigation of H-02: See comments

Lines of code Vulnerability details The PR applies the recommended mitigation from the finding, but doesn't take into account the rounding issue identified in M-09 Impact If the price the NFT is bought for is not an exact multiple of the filledQuantities, there will be a loss of precision, and...

User might not be able to claim refund when the NFT is bought for less than the minimum reserve price

Lines of code Vulnerability details Impact User might not be able to claim refund when the NFT is bought for less than the minimum reserve price because the minReservePrices is rounded down, which make the contract refund sightly more eth to each user. In most case, the last user will not be able...

driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people.

Lines of code Vulnerability details Impact driverID can make same userID registered under different different driverID's leading to loss of funds and ultimately the trust of people. Proof of Concept In contract dripsHub their is no mechanism to check a user already registered under driverID or no...

Mitigation of M-08: See comments

Lines of code Vulnerability details The PR applies the recommended mitigation from the finding, but the original finding's mitigation suggestion seems to indicated that the If two users place bids at the same price but with different quantities, the queue will pull from the bid with a higher...

Unpacking the "0x1626ba7e" Mystery: The Risks of Unidentified Fixed Values in Smart Contracts - loss of funds

Lines of code Vulnerability details Impact The use of a fixed value in the require statement without understanding its significance creates a security vulnerability in the contract. An attacker could manipulate the returned value to bypass the require statement and execute malicious code. This ca...

GroupBuy may purchase NFT not in the allowed list

Lines of code Vulnerability details The issue that is described in code-423n4/2022-12-tessera-findings14 was not mitigated and still applies like it is described there. --- The text was updated successfully, but these errors were encountered: All reactions...

Overflow Vulnerability in Splits Contract Due to Maximum Splits Receivers Limitation (_MAX_SPLITS_RECEIVERS = 200)

Lines of code Vulnerability details Impact If more than 200 splits receivers are added for a single user, the constant MAXSPLITSRECEIVERS will be exceeded, causing unexpected behavior in the contract uint256 internal constant MAXSPLITSRECEIVERS = 200; Proof of Concept a. Create an array of splits...

Attacker can DOS OptimisticListing with very low cost

Lines of code Vulnerability details The issue that is described in code-423n4/2022-12-tessera-findings25 was not mitigated and still applies like it is described there. --- The text was updated successfully, but these errors were encountered: All reactions...

Orders may not be fillable due to missing approvals

Lines of code Vulnerability details The issue that is described in code-423n4/2022-12-tessera-findings36 was not mitigated and still applies like it is described there. --- The text was updated successfully, but these errors were encountered: All reactions...

Loss of ETH for proposer when it is a contract that doesn't have fallback function.

Lines of code Vulnerability details The issue that is described in code-423n4/2022-12-tessera-findings40 was not mitigated and still applies like it is described there. --- The text was updated successfully, but these errors were encountered: All reactions...

Attacker can delay proposal rejection

Lines of code Vulnerability details The issue that is described in code-423n4/2022-12-tessera-findings24 was not mitigated and still applies like it is described there. --- The text was updated successfully, but these errors were encountered: All reactions...

Only one GroupBuy can ever use USDT or similar tokens with front-running approval protections

Lines of code Vulnerability details The issue that is described in code-423n4/2022-12-tessera-findings37 was not mitigated and still applies like it is described there. --- The text was updated successfully, but these errors were encountered: All reactions...

Enormous tokens can be minted by malicious user via reentrancy

Lines of code Vulnerability details Impact The function safeMInt that is used to mint new tokens, makes an external call to ERC721.sol's safeMint which contains a callback to the "to" address argument. checkOnERC721Receivedaddress0, to, tokenId, data safeMint lacks a reentrancy guard, a malicious...

Gas Optimizations

See the markdown file with the details of this report here. --- The text was updated successfully, but these errors were encountered: All reactions...

Incorrect _removeTokenEnumeration implementation of ERC1155Enumerable

Lines of code Vulnerability details Impact removeTokenFromAllTokensEnumeration can never be called, because of wrong order of if statement and idTotalSupplyid -= amount;. This leads to totalSupply do not correctly minus 1 when all token amounts for a specific tokenId get burned. Proof of Concept...

All Transfer Hooks have incomplete checks which might lead to transactions reverting

Lines of code Vulnerability details Impact Due to not checking that the ids array and amounts array are same , if given the two arraya of non-equal length it might lead to incorrect token transfers and unwanted transaction reverts. Proof of Concept According to the EIP specification the ids array...

Timeswap Options has no reentry check and is providing a set of flashloan with no fees

Lines of code Vulnerability details high-flashloan-provider @timeswap Impact In the file /package/v2-option/TimeswapV2Option.sol, There are a range of functions that has no Reentry check. As a consequence, when the contract call back msg.sender, an attacker can then reeentry in his own callee...

sqrtDiscriminant can be calculated wrong

Lines of code Vulnerability details Impact Due to the wrong calculation of short and long tokens during the leverage and deleverage process, the users can suffer financial loss while the protocol will lose fees Proof of Concept The protocol uses leverage function to deposit short tokens and recei...

In TimeswapV2LiquidityToken.sol and TimeswapV2Token.sol, different positions might be minted to the same id.

Lines of code Vulnerability details Impact In this protocol, all positions should have unique ids to track and update their status. Currently, different positions might be minted to the same id and the main logic for the positions will be broken. Proof of Concept TimeswapV2LiquidityToken.mint set...

TimeswapV2LiquidityToken should not use totalSupply()+1 as tokenId

Lines of code Vulnerability details Impact Assuming ERC1155Enumerable is acting normally, there is a Accounting Issue about TimeswapV2LiquidityToken and TimeswapV2Token's tokenId. Different liquidities can have the same tokenId, leading to serious balance manipulation. I'm submitting this issue a...

User can open position without depositing tokens

Lines of code Vulnerability details Impact User can mint long/short tokens without depositing anything. This is because the function on LN 172 doesn't check the contents of the returned data from the function, and the function doesn't verify that the contract has indeed received the expected...

[H-01] Lack of access control allow attacker to transferTokenPositionFrom()with other user's wallet balance

Lines of code Vulnerability details Impact This issue allows anyone to transferTokenPositionFrom and steal almost all their wallet balances for all the users who have approved the contract before. Proof of Concept Funds are transferred from the from parameter, and the output tokens are transferre...

Malicious lender can create pool imbalance by tricking V2 pool into accepting disproportionately large number of long tokens in exchange for short tokens

Lines of code Vulnerability details Impact Timeswap V2 Pool works on constant product AMM where the total long tokens & short tokens follow the equation total long total short = L. Any increase in short tokens caused by lenders has to be accompanied with a proportionate drop in long tokens to kee...

QA Report

See the markdown file with the details of this report here. --- The text was updated successfully, but these errors were encountered: All reactions...

Gas Optimizations

See the markdown file with the details of this report here. --- The text was updated successfully, but these errors were encountered: All reactions...

Malicious borrower can create pool imbalance by tricking the V2 pool to send lesser number of long tokens in exchange for short tokens

Lines of code Vulnerability details Impact Timeswap V2 Pool works on constant product AMM where total long tokens & short tokens follow the equation total long total short = L. Any increase in long tokens has to be accompanied with a proportionate drop in short tokens and viceversa to ensure that...