attacker can create un collateralized debt by reentrancy attack during _removeCollateral() by removing all collaterals and liquidating the last one which would set debt to zero. unfair liquidation can happen with reentrancy too

Lines of code Vulnerability details Impact Function removeCollateral removes collateral from msg.senders vault and code allows for onReceive hook to sell and repay debt before the debt check. during the hook function user can call other function of the PaprController contract, it's possible for...

Liquidations force users into bigger debts

Lines of code Vulnerability details Impact User's uncovered debt increases when auction starts on their collateral token. The increased debt may be too big for a user and they might not be able to repay it, which forces them to wait for the auctioned token to be sold and accrue more debt due to t...

Signature mallebaility in underwritePriceForCollateral

Lines of code Vulnerability details Impact underwritePriceForCollateral has signature malleability as it doesn't check for a returned address of not 0. Value can be set to 0 oracleSigner Proof of Concept function underwritePriceForCollateralERC721 asset, PriceKind priceKind, OracleInfo memory...

Users may be liquidated right after taking maximal debt

Lines of code Vulnerability details Impact Since there's no gap between the maximal LTV and the liquidation LTV, user positions may be liquidated as soon as maximal debt is taken, without leaving room for collateral and Papr token prices fluctuations. Users have no chance to add more collateral o...

Underlying With Non-Standard Decimals Not Supported

Lines of code Vulnerability details Impact Arithmetic operations are performed with the assumption that the token always has 18 decimals. Proof of Concept It would not be possible without using 18 decimal places of the base capital. Tools Used vscode Recommended Mitigation Steps Consider whether...

Malicious user able to start auction to any NFT

Lines of code Vulnerability details Impact Any address can start an auction for an NFT, regardless of whether they are the actual owner of the NFT. This vulnerability could allow an attacker to start auctions for NFTs that they do not own, potentially leading to financial losses for the true owne...

PaprController is vulnerable to reentrancy attacks

Lines of code Vulnerability details Impact Malicious users can steal PAPR tokens through reentrancy attacks. Proof of Concept Function PaprController.purchaseLiquidationAuctionNFT may trigger a reentrancy becase it calls ERC721.safeTransferFrom in NFTEDA.purchaseNFT:...

Wrong implemention of ERC721TokenReceiver interface leads to incorrect collateral ownership and NFT loss

Lines of code Vulnerability details Impact To add a collateral, one could send the NFT directly to the contract, onERC721Received is called then to handle adding the collateral to the vault. However, if the user sends the NFT via an operator then the ownership of the collateral will be assigned t...

ownerMintUsingTokenId can brick the whole contract

Lines of code Vulnerability details Impact With the function ownerMintUsingTokenId, it is possible for the owner to mint a token with an arbitrary token ID. However, this can brick the whole contract and cause a situation where no more mints / buys are possible. This happens when a token ID is...

Oracle may return a stale price that is not resistant to flash crashes

Lines of code Vulnerability details Impact Oracle may return a stale price in the event of a flash crash which will affect protocol calculation of maxDebt and affect protocol. Proof of Concept Protocol uses the time weighted average pricing of 30 days to check the price of the NFT. uint256 consta...

PaprController.sol: reservoir oracle price equal to 0 allows bypassing NFT liquidations

Lines of code Vulnerability details Impact When there is a reservoir oracle message with the price of the NFT equal to zero, the debt of a vault will be reset in the PaprController.purchaseLiquidationAuctionNFT function when a NFT is bought in an auction. So the borrower can now withdraw all othe...

Misunderstanding operator with from

Lines of code Vulnerability details Author: rotcivegaf Impact The owner of the ERC721 token could approve an operator to manage his tokens With the misunderstanding of operator with from in the onERC721Received function the benefits of this function goes to the operator instead of the fromowner:...

PaprController.onERC721Received() assigns collateral to operator's vault instead of the nft owner's one

Lines of code Vulnerability details Impact The collateral is assigned to the operator's vault because of a parameter mismatch. This impacts the ability of third parties to integrate the PaprController contract. You're not able to create an intermediary contract that adds collateral to a user's...

Protocol faces truncation issue in some places due to solidity integer division

Lines of code Vulnerability details Impact UniswapOracleFundingRateController.sol : periodRatio , targetMarkRatio - less multiplier output than the actual value that is possible. EDAPrice.sol: again the final outcome affects the multiplier. Please refer the code link in POC. PaprController.sol:...

Some NFTs could be possibly stuck and can not be withdrawn when removing the collateral

Lines of code Vulnerability details Impact When adding a collateral, the protocol transfers the NFT from the user to the contract by calling ERC721's transferFrom, and when removing the collateral, safeTransferFrom is called to allow for onReceive hook to be triggered as intended by the protocol...

fundingRate formula and _multiplier()

Lines of code Vulnerability details Impact The formula used formultiplier will not work as expected. The target price update will be inaccurate and all the borrow/repay/liquidation functions will use the inaccurate target price. The impacts might be: Target price and mark price track will not wor...

Collateral NFT deposited to a wrong address, when transferred directly to PaprController

Lines of code Vulnerability details Impact Users will lose collateral NFTs when they are transferred to PaprController by an approved address or an operator. Proof of Concept The PaprController allows users to deposit NFTs as collateral to borrow Papr tokens. One of the way of depositing is by...

totalCollateralValue in maxDebt may not be calculated correctly everytime

Lines of code Vulnerability details Impact totalCollateralValue in maxDebt may not be calculated correctly sometimes which leads to questionable lending procedures. Proof of Concept Bob has 10 BAYC NFTs, one of which is an extremely rare one with a crown and a rainbow body, which costs about 150...

Start an auction without an NFT

Lines of code Vulnerability details Impact Requires that the account being liquidated has more than one NFT in PaprController. When an operator calls purchaseLiquidationAuctionNFT the price variable is determined by a call to purchaseNFTAndUpdateVaultIfNeeded which calls purchaseNFT which calls...

if msg.sender != account, then msg.sender double pays in buyAndReduceDebt

Lines of code Vulnerability details Impact If msg.sender chooses to pay for some other account's debt, then he has to pay double. Proof of Concept msg.sender first has to pay the underlying tokens the paprToken from the swap goes to account controller then burns the papr tokens from msg.sender...

function underwritePriceForCollateral() uses message.timestamp > block.timestamp to validate oracle message timestamp but it can create MEV as miners can control block.timestamp and revert some of the user's transactions

Lines of code Vulnerability details Impact Function underwritePriceForCollateral validates the oracle message which includes the price of the NFT and returns the price of an asset from a signed oracle message. to check the validity of the message's timestamp code checks that if...

code doesn't check that To address is not 0x0 in contract function, if user call contract's function with wrong value he would lose his funds

Lines of code Vulnerability details Impact There is no sanity checks when user wants to get loan or ... for a to address and if the value of to set as 0 user would lose those funds. Proof of Concept none of the functions increaseDebtAndSellmintTo, , increaseDebtmintTo, ,...

Stealing fund by applying reentrancy attack on removeCollateral, startLiquidationAuction, and purchaseLiquidationAuctionNFT

Lines of code Vulnerability details Impact By applying reentrancy attack involving the functions removeCollateral, startLiquidationAuction, and purchaseLiquidationAuctionNFT, an Attacker can steal large amount of fund. Proof of Concept Bob a malicious user deploys a contract to apply the attack...

setFundingPeriod leads to Price control

Lines of code Vulnerability details Impact Attacker can use two different addresses to borrow from himself at different interest rates. Proof of Concept AS the papr interest rates and the papr trading price are in a constant feedback loop. Interest rates are programmatically updated on chain as a...

Insufficient Timestamp Validation for Signed Messages

Lines of code Vulnerability details Impact A message can be signed by the oracle for any future point in time, and it will be valid for 20 minutes. If messages with invalid timestamps pointing to the future get signed, there is no way of invalidating them. A compromised or malfunctioning oracle...

Upgraded Q -> M from #22 [1671528877220]

Judge has assessed an item in Issue 22 as M risk. The relevant finding follows: minBidPrices is rounded down --- The text was updated successfully, but these errors were encountered: All reactions...

Borrowers may earn auction proceeds without filling the debt shortfall

Lines of code Vulnerability details Impact The proceeds from the collateral auctions will not be used to fill the debt shortfall, but be transferred directly to the borrower. Proof of Concept Assume N is an allowed NFT, B is a borrower, the vault V is vaultInfoBN: 1. B add two NFTsN-1 and N-2 as...

Upgraded Q -> M from #4 [1671527898955]

Judge has assessed an item in Issue 4 as M risk. The relevant finding follows: GroupBuy.contribute does not set pendingBalances for unused capital, leading to locked up money --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from #22 [1671528533640]

Judge has assessed an item in Issue 22 as M risk. The relevant finding follows: NC-2 Return values of approve not checked --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from #27 [1671522165760]

Judge has assessed an item in Issue 27 as M risk. The relevant finding follows: Dup of 45. The effect is severe enough IMO to warrant a med severity although I initially intepreted it as a spec mismatch. --- The text was updated successfully, but these errors were encountered: All reactions...

The patch is not sufficient: there is another insidious exploit that can cause the same critical consequences

Lines of code Vulnerability details Status Has been reported to and confirmed by Jeff ENS team Note to the Judge I am not sure whether I should label this as a newly-identified High or a mitigation hard error. The root cause of this issue seems as same as the original report, but this requires us...

Pair.sol : baseTokenReserves() can be manipulatable if the base token is native token

Lines of code Vulnerability details Impact Price manipulation in following functions wherever the baseTokenReserves; is called. buyQuote, sellQuote, addQuote, removeQuote Proof of Concept function baseTokenReserves internal view returns uint256 return baseToken == address0 ? addressthis.balance -...

Using safeTransferFrom() Functions But without Getting the Approval

Lines of code Vulnerability details Impact 2 safeTransferFrom calls are Used for ERC20 Token Line: 90, 172 using SafeTransferLib But without getting the Approval using safeApprove function. The Calls will always fail. 3 more safeTransferFrom calls are Used for ERC721 Tokens Line: 239, 259, 370...

Earlier bidders get cut out of future NFT holdings by bidders specifying the same price.

Lines of code LOC: Vulnerability details Description In GroupBuy module, users can call contribute to get a piece of the NFT pie. There are two stages in transforming the msg.value to holdings in the NFT. 1. filling at any pricesupply is not yet saturated uint256 fillAtAnyPriceQuantity =...

Tokens are expected to have 18 decimals but not all have them

Lines of code Vulnerability details Tokens are expected to have 18 decimals but not all have them Summary Pairs doesn't consider tokens with less or more than 18 decimals Impact Tokens not compatible Proof of Concept Mitigation Don't use hardcoded 18 decimals --- The text was updated successfully...

Pair.sol contract is susceptible to having its pricing curve (x*y = k) manipulated through a 3rd party contract calling selfdestruct() and forwarding ether.

Lines of code Vulnerability details Impact If a pair is denominated in ether, a third party contract can forward ether to the contract using the selfdestruct function passing the pair's address. The impact of this is that the pair will allow its market making curve to be manipulated. Among other...

Any user which holds Raes tokens can infinitely freeze NFT in OptimisticListingSeaport

Lines of code Vulnerability details Description OptimisticListingSeaport exposes propose method to create new proposal, and rejectProposal to remove a listing in proposal stage. In propose, proposer commits a certain amount of collateral: // Sets collateral amount to pending balances for withdraw...

Early user can break the minting of LP Tokens

Lines of code Vulnerability details Impact The attack vector is the same as TOB-YEARN-003, where users may not receive liquidity tokens in exchange for their baseTokenAmount and fractionalTokenAmount deposited if the total baseTokenAmount has been manipulated through a large “donation”. In the...

User loses collateral converted to pendingBalance when cash() or list() is called

Lines of code Vulnerability details Description In OptimisticListingOpensea, there are several functions which update pendingBalances of a proposer: 1. list 2. cash 3. propose Unfortunately, in list and cash the = operator is used instead of += when writing the new pendingBalances. For example:...

MISSING HANDLE FOR DIRECT SEND OF TOKEN

Lines of code Vulnerability details Impact The current implementation of the protocol does not handle situations when tokens are sent directly to the pair contract. Tokens directly send to the contract can affect the calculation of baseTokenReserves which affect buyQuoute and sellQuoute. Below is...

Loss of ETH for proposer when it is a contract that doesn't have fallback function.

Lines of code Vulnerability details Description sendEthOrWeth is used in several locations in OptimisticListingSeaport: 1. rejectProposal - sent to proposer 2. rejectActive - sent to proposer 3. cash - sent to msg.sender This is the implementation of sendEthOrWeth: function...

User can send a proposal and instantly take back their collateral, keeping the proposal active without risking any Raes amount.

Lines of code Vulnerability details Description In OptimisticListingSeaport.sol, users call propose to set a new proposal. The pendingBalance is updated immediately for the calling proposer: // Sets collateral amount to pending balances for withdrawal pendingBalancesvaultproposedListing.proposer ...

[M-0] Unhandled return values of transfer

Lines of code Vulnerability details c4udit Report Issues found M-0 Unhandled return values of transfer Impact Some implementations of transfer could return ‘false’ on failure instead of reverting. Findings: src\Pair.sol::85 = transferFrommsg.sender, addressthis, fractionalTokenAmount;...

Upgraded Q -> M from #163 [1671458931869]

Judge has assessed an item in Issue 163 as M risk. The relevant finding follows: TOKEN TRANSFERS DO NOT VERIFY THAT THE TOKENS WERE SUCCESSFULLY TRANSFERRED Some tokens like zrx do not revert the transaction when the transfer/transferfrom fails and return false, which requires us to check the...

First depositor can break the price of shares

Lines of code Vulnerability details Impact The first depositor of the pool can wreck up the price of the shares for the future depositors mostly as the pair launches because of the rounding. Proof of Concept 1. Bob wraps 1 NFT deposits and received 1e18 denominations of fractionalTokens 2. Bob...

Bids are wrongly ordered when prices and quantities are equal.

Lines of code Vulnerability details Description In GroupBuy, when total amount of Raes is filled up with purchases, users start competing with higher price offers. Their bids are laid out in a min priority queue structure implemented in MinPriorityQueue.sol. The docs clearly state that when two...

in add function forgot to add not zero for minimum lp

Lines of code Vulnerability details Impact problems in the calculation of the system Proof of Concept requirebaseTokenAmount 0 && fractionalTokenAmount 0, "Input token amount is zero"; Tools Used manually Recommended Mitigation Steps add checks like basetoken --- The text was updated successfully...

First depositor can break minting of shares

Lines of code Vulnerability details Impact The attack vector and impact is the same as TOB-YEARN-003, where users may not receive shares in exchange for their deposits if the total asset amount has been manipulated through a large “donation”. Proof of Concept In Pair.add, the amount of LP token...

## MALICIOUS OWNER CAN CLOSE AND WITHDRAW AS HE WANT

Lines of code Vulnerability details MALICIOUS OWNER CAN CLOSE AND WITHDRAW AS HE WANT These functions below are set some emergency scenarios. But caviar.Owner able to triggered these functions as he want. Need to set some require statement in order to actually check these scenarios before his...

Centralization Risks, Rug pull vectors

Lines of code Vulnerability details Impact Owner can mint or burn unlimited tokens, functions can be used to rug pull the project. Proof of Concept Although owner role is supposedly not malicious, if owner's wallet keys are compromised, an attacker could rug the project. Based on the fact that we...