sanket-722/reads

Reports I Read

Reports

Simply want to collect reports which i read day in and out.

Solidity Reads

Rug Pull :

1. [M] Schain owners can rug pull users' funds
2. [M] Centralisation risk: admin role of TokenManagerEth can rug pull all Eth from the bridge
3. [M] compromised owner can drain funds fromVeTokenMinter.sol
4. [M] VoterProxy incorrectly assumes a 1-1 mapping between the gauge and the LP tokens.

Constructor

1. [M] NPM Dependency confusion. Unclaimed NPM Package and Scope/Org
2. [M] No use of upgradeable SafeERC20 contract in Controller.sol
3. [M] Inconsistency between constructor and setting method for slippageTolerance
4. [M] ERC721SeaDrop owner can choose an address they control as the admin when the constructor is

NFT

1. [M] Use safeTransferFrom instead of transferFrom for ERC721 transfers
2. QSP-1 Max supply of 500 is not enforced at the token level
3. QSP-2 Minter can burn token on any address
4. [M]Possibility of DOS due to overflow

DOS

1. [M] Possible DOS in 'allVestingRecipients()' function because of unbounded gas consumption.
2. [M] [Denial-of-Service] Contract Owner Could Block Users From Withdrawing Their Strike
3. [H] Denial of Service
4. [M] Malicious users could block liquidation or perform DOS
5. Vault can be placed back into vulnerable low supply state
6. Potential funds locked due low token decimal and long stream duration
7. [M] Unhandled chainlink revert would lock all price oracle access
8. [H] PEUSD.CONVERTTOPEUSD() CALL COULD CAUSE A DENIAL OF SERVICE IN THE DISTRIBUTEREWARDS FUNCTION

Conditional

1. [M] !_account.isContract() can be bypassed
2. Passing multiple ETH deposits in orders array will use the same msg.value many times

Functional

1. [M] Unsafe call to ERC20::transfer can result in stuck funds.
2. [H] First vault depositor can steal subsequent depositors’ tokens.
3. [M] UniswapV3’s path issue for swapExactOutput
4. [M] https://solodit.xyz/auth?next=/issues/m-01-code4rena-blockswap-blockswap-formal-verification-contest-with-certora-git
5. [M] Cancellation refunds should return tokens to order creator, not recipient
6. [M] M-2: Because of rounding issues, users may not be able to withdraw airdrop tokens if their claim has been adjust()'ed upwards
7. [M] Gas stipend for external call might be insufficient and lead to stuck ETH
8. [WP-H3] L1Migrator.sol#migrateETH() Improper implementation of L1Migrator causing migrateETH() always reverts, can lead to ETH in BridgeMinter getting stuck in the contract
9. [M] Gas stipend for external call might be insufficient and lead to stuck ETH
10. [M] Any native assets in the LiFiDiamond can be took by anyone
11. [M] Ether can be locked in the PoolFactory contract without a way to retrieve it
12. Stop Using Solidity's transfer() Now
13. [M] BLOCK_PERIOD is incorrect
14. keccak123 - abi.encodePacked Allows Hash Collision
15. XSS via SVG Construction contract
16. 'onlyEOAEx' modifier that ensures call is from EOA might not hold true in the future
17. THORChain_Router’s‌‌transferOut‌‌ does‌‌ not‌‌ check‌‌ transfer‌‌ return‌‌ values No 8

Logical

1. getUserInfo() returns incorrect values for locked and stakedAmount
2. Maximal approvals remain for the AssetManager's adapters and tokens after removal
3. CURVEPOOL.EXCHANGEUNDERLYING() CALL COULD CONSTANTLY REVERT IN THE DISTRIBUTEREWARDS FUNCTION

Swap

1. [M] UNISWAP_FEE is hardcoded which will lead to significant losses compared to optimal routing
2. [M] SWAP_ROUTER in AutoPxGmx.sol is hardcoded and not compatible on Avalanche
3. [M] AddLiquidity and decreaseLiquidity missing slippage protection
4. [M] Duplicate LP token could lead to incorrect reward distribution
5. Missing fromToken != toToken check in MarginRouter.crossSwapExactTokensForTokens/MarginRouter.crossSwapTokensForExactTokens
6. [H] swapTokens Function Is Unusable
7. LP tokens can be transferred to empty address

Oracle

1. _updateTwav() and _getTwav() will revert when cumulativePrice overflows
2. [M] Chainlink’s latestRoundData might return stale or incorrect results
3. Should check return data from Chainlink aggregators
4. ChainlinkAdapterOracle use BTC/USD chainlink oracle to price WBTC which is problematic if WBTC depegs
5. .latestRoundData() does not update the oracle - ExchangeRate.sol
6. MISUSE OF AN ORACLE
7. ChainlinkAdapterOracle will return the wrong price for asset if underlying aggregator hits minAnswer
8. Oracle periodSize = 0 which is as same as not using any oracle.
9. latestRoundData() has no check for round completeness
10. MISSING STALENESS CHECKS IN THE CHAINLINK.LATESTROUNDDATA() CALLS

Decimal

1. Interest accrued could be zero for small decimal tokens
2. WithdrawPeriphery uses incorrect value for MAX_BPS which will allow much higher slippage than intended
3. Basis points constant BPS_MAX is used as minimal fee amount requirement
4. [M] IMPRECISE INTEREST RATE CALCULATIONS

Dynamic Thinking

Math

1. Permanent freeze of vested tokens due to overflow in _baseVestedAmount
2. Lack of sanity check on _initialTokenSupply and _initialTokenPrice can lead to a seller losing his NFT
3. Unsafe downcasting arithmetic operation in UserManager related contract and in UToken.sol
4. FRAX admin can adjust fee rate to harm Napier and its users
5. Incorrect unlockTime can DOS withdrawGovernanceAsset

Tokens

1. AutoleverageBase: Must approve 0

Rounding

AMM

1. block.timestamp or deadline
2. Existing token hooks are replaceable while adding new

Access Control

1. Any public vault without a delegate can be drained
2. Malicious actors can lock all FEI and TRIBE in the GenesisGroup
3. onlyOwner Role Can Unintentionally Influence "settleAuction()"
4. [M]Hackers can deploy token with respective name as the stable one to impersonate the stable token
5. [C] Slot Collision

CrossChain

1. [M] It Will Not Be Possible to Bridge DAI to Blast
2. [L] Error-Prone Initialization of Blast_Adapter.sol
3. [L] Permit2 Witness Is Not Fully Compliant With EIP-712
4. [L] Users May Lose Assets if They Specify an Empty Address as a Call Target 5. MintCap Check Missing in Cross-Chain Transfer

Other

1. Incorrect hardcoded address
2. Incorrect comparison operator while checking

ERC20

1. Transfer token without user approval
2. Potential locking of funds due to non standard ERC20 transfers
3. [C] INCORRECT ERC-20 TOKEN VALUATION
4. [C] MAINTAINERS MAY NOT BE ABLE TO PERFORM LIQUIDATIONS
5. [C] POSSIBLE ACCOUNT TAKEOVER BY A MALICIOUS USER

Go Reads

Cosmos SDK

1. Incorrect Signers
2. Non-determinism
3. Proposal: deterministic execution
4. Non-deterministic rank calculation

Math

1. Incorrect implementation of integer math functions

Rust Reads

Dynamic Thinking

1. The user index is not updated if the computed reward is zero

Rounding

1. Users might receive more funds due to rounding issue

Pentest Web3.0 Projects

Bugs to look for Pentest :

1. [H] Private Key Leaked in Server Logs for ETH Wallet
2. [H] Hardcoded Secrets, Api Keys, Private keys and more
3. [M] Lack of Rate Limiting
4. [M] Lack of Authentication in API Endpoints
5. [M] Id param issue in 'get_Notification_By_Id'