GitHubHelp

juancito-dev/audits

Smart Contract Audits and Findings by @0xJuancito

★ 30Forks 1GitHub ↗Compare

Project website ↗

README

Smart Contract Audits and Findings by 0xJuancito

Reach out on Twitter @0xJuancito for security consulting and private audits.

Audit Competitions

🔐 +100 High/Medium severity bugs found in public competitions

Notes: 🏆 Selected for Report
Project Severity Finding Notes
EigenLayer High It is impossible to slash queued withdrawals that contain a malicious strategy due to a misplacement of the ++i increment 🏆
EigenLayer Medium Conflicting strategy can lead to reverting the whole withdrawal and temporary freeze user assets from other strategies
EigenLayer QA QA Report
Lens Protocol Medium Lens Handles from v1 can be minted by other users on v2 before they are migrated to their corresponding owner
Lens Protocol Medium Users can make any user follow them via FollowNFT::tryMigrate() without their consent 🏆
Lens Protocol Medium Users can self-follow via FollowNFT::tryMigrate() on Lens V2 🏆
Lens Protocol Medium Implementation error of EIP-712 due to wrong Typehash can lead to tx reverts
Lens Protocol Medium Missing pause modifier on important LensV2Migration and FollowNFT functions
Lens Protocol QA QA Report
Chainlink Report 2nd Best Report 🥈
Ajna High Anyone can call memorializePositions() on behalf of other user's position due to lack of access control
Ajna Medium Adversary can prevent the creation of any extraordinary funding proposal by frontrunning proposeExtraordinary() 🏆
Lybra High Missmatch in supportVotes[] order in LybraGovernance
Lybra Medium Incorrect use of token.decimals() leads to error in rewards calculation and distribution
Lybra Medium StakingRewardsV2 does not impose any restriction regarding esLBRBoost unlock time
Lybra Medium It is impossible to mint PeUSD tokens via the LybraRETHVault and LybraWBETHVault contracts due to incorrect interface
Stader Labs Medium addBid() does not increment the endBlock of the auction when it is close to the end, preventing the protocol from capturing extra value
Stader Labs Medium Stale or incorrect results from data feeds can affect assets and shares calculation on deposits and withdrawals
Stader Labs Medium Lack of Pause and Unpause Functionality in Auction Contract
Stader Labs QA QA Report
Stader Labs Gas Gas Report
Dopex High All options settlements can be blocked with a permanent DOS of the settle() function
Dopex Medium Missing slippage parameter on Uniswap addLiquidity() function 🏆
Dopex Medium The owner of RPDX Decaying Bonds is not updated on token transfers 🏆
Dopex QA QA Report 🏆
Frankencoin High Fresh positions can be instantly challenged leading to unrestricted minting of ZCHF tokens
Frankencoin High Position owners can perform a sandwich attack against challengers to steal their collateral
Frankencoin High Adjusting position prices can lead to unavertable challenges that the protocol will have to pay for
Frankencoin High Lack of validation in opening positions parameters can lead to critical vulnerabilities at protocol level
Frankencoin Medium restructureCapTable() only wipes out the first address on the list
Frankencoin Medium No way to transfer minter role or rennounce to it
Frankencoin QA QA Report 🏆
NextGen High Max minting limit can be bypassed via re-entrancy
NextGen High Ether from the Auction contract can be stolen on the block the auction ends
NextGen High Highest bidder can cancel their bid to win auctions for free
NextGen High Adversary can block claimAuction() due to push-strategy to transfer assets to multiple bidders 🏆
NextGen Medium The owner of the auctioned token does not receive the funds after an auction ends
NextGen Medium Artist signatures can be forged to impersonate the artist behind a collection 🏆
NextGen Medium Auction winner can prevent payments via safeTransferFrom callback 🏆
NextGen QA QA Report 🏆
ReNFT Mitigation High All orders can be hijacked to lock rental assets forever by tipping a huge amount of small ERC20 tips
AI Arena High Non-transferable Game Items can be transferred using safeBatchTransferFrom()
AI Arena High FighterFarm security checks for transfers can be avoided by using the version of safeTransferFrom() with data
AI Arena High Incrementing a fighter type generation will brick the element attribute selection forever because of a missing function to update numElements
AI Arena High Users with minting passes can mint fighters that are both Dendroids and Icons
AI Arena High Fighters can be rerolled with a different fighterType than their own
AI Arena High Users redeeming a mint pass can mint Icon fighters with any iconsType, including inexisting ones
AI Arena High Precision error in curStakeAtRisk
AI Arena Medium The rarity of the last physical attribute in the probability array is undermined
AI Arena Medium Fighters can be minted with out of range weight, and element attributes via MergingPool::claimRewards()
AI Arena Medium Rerolling allows users to outwin the pseudo-randomness of fighters DNA to mint NFTs with the best stats
AI Arena Medium Roles can't be revoked
AI Arena QA QA Report
Althea Medium setDistributableERC20s() should check there is no ongoing distribution to prevent bricking the contract
Althe Medium ERC20 tokens should be distributed before removing them from LiquidInfrastructureERC20
Althea Medium Withdrawals can be bricked if releasing more than one NFT during ongoing withdrawal
Salty High Users can avoid liquidations by abusing the cooldown mechanism
Salty High USDS is sent to the wrong contract when repaying borrowed USDS
Salty Medium Adversary can prevent updating price feed addresses by creating poisonous proposals ending in _confirm 🏆
Salty Medium DOS of proposals by abusing ballot names without important parameters 🏆
Salty Medium Proposals that didn't reach quorum should be able to be finalized without changes when the voting phase ends
Salty Medium Wallet proposals aren't reset when they are rejected
Salty Medium Chainlink price feed uses BTC/USD feed instead of one with WBTC
Salty Medium Pools reserves can be manipulated because of failed check of remaining reserves on removeLiquidity()
Salty Medium proposeWallets enters in a deadlock if the proposed wallet doesn’t call changeWallets()
Salty QA QA Report 🏆
USSD High USSDRebalancer::getOwnValuation() is easy to manipulate as it doesn't use TWAP for getting the pool price
USSD High USSD::UniV3SwapInput() executes swaps with no slippage protection
USSD High The protocol can't rebalance because USSD::UniV3SwapInput() will revert as it is missing the deadline when creating the ExactInputParams for the swap
USSD High StableOracleWBTC::getPriceUSD() is using ETH/USD as its price feed
USSD High getPriceUSD in StableOracleDai is miscalculated with wrong decimals from the priceFeedDAIETH Chainlink feed
USSD High StableOracleDAI calculates getPriceUSD with inverted base/rate tokens for Chainlink price 🏆
USSD High Static oracles in StableOracleDAI and StableOracleWBGL have wrong addresses
USSD High ethOracle is not defined in StableOracleDAI making getPriceUSD always revert
USSD High Missing access control on burnRebalancer allows unrestricted burning of USSD tokens by anyone affecting pool balance on rebalance
USSD High Missing access control on mintRebalancer allows unrestricted minting of USSD tokens by anyone affecting pool balance on rebalance
USSD Medium latestRoundData from Chainlink might return stale or incorrect results
USSD Medium There is no method for redeeming DAI to prevent negative scenarios described in the whitepaper
USSD Medium Collateral tokens will be stuck on the contract and will be unusable after calling USSD::removeCollateral()
Footium Medium Some ERC20 tokens can get permanently stuck in the contract due to use of transfer()
Footium Medium Increasing _maxGenerationId allows extra minting of academy players on previous seasons
Footium Medium One extra academy player can be minted per season due to mischeck in mintPlayers
Gravita Low Out of gas in collectFees
Teller High Borrowers can steal lenders principal without providing collateral by frontrunning lenderAcceptBid and updating the bid
Teller High Adversary can modify the commited collateral of any bid at any time leading to lost or locked assets and DOS of the protocol
Teller Medium Marketplaces owners can frontrun submitBid to steal collateral by modifying market parameters
Caviar Private Pools Medium Adversary can prevent the creation of any private pools by frontrunning the deployer
Canto Identity Subprotocols Medium Users can end up buying and paying for a different Tray than the one they were trying to acquire 🏆
Neo Tokyo High A malicious user can mint a huge amount of BYTES 2.0 tokens for himself
Neo Tokyo High Malicious users can claim BYTES rewards after withdrawing all of their LP stake
Wenwin QA QA Report
Hats Medium Transactions will be frozen if incorrect settings are used during a deployment on HatsSignerGateFactory
Biconomy QA QA Report
Polynomial High KangarooVault.removeCollateral doesn't remove the collateral from the position
Polynomial Medium Invalid and stale prices from Synthethix are not validated
Polynomial Medium Spamming deposit and withdraw queues
Polynomial QA QA Report
Asymmetry High Adversary can alter derivatives balances in contracts to steal Ether
Asymmetry Medium Precision loss in stake function affects share calculation
Asymmetry Medium Remaining dust from Ether deposits is not returned to users
Asymmetry QA QA Report
Arcade QA Report TBA 🏆
reNFT High Report TBA
reNFT High Report TBA
reNFT High Report TBA
reNFT Medium Report TBA
reNFT Medium Report TBA
reNFT Medium Report TBA
reNFT Medium Report TBA
reNFT Medium Report TBA
reNFT QA Report TBA
zkSync Era Medium Report TBA
zkSync Era Medium Report TBA
zkSync Era QA Report TBA
Chainlink Staking Medium Report TBA
Chainlink Staking Medium Report TBA
Chainlink Staking Medium Report TBA
Chainlink Staking Medium Report TBA
Chainlink Staking QA Report TBA
Rubicon v2 High Report TBA
Rubicon v2 Medium Report TBA
Rubicon v2 Medium Report TBA
Contest 225 High Report TBA
Contest 225 High Report TBA
Contest 225 High Report TBA
Contest 225 High Report TBA
Contest 225 High Report TBA
Contest 225 High Report TBA
Contest 225 Medium Report TBA
Contest 225 Medium Report TBA
Contest 225 QA Report TBA

Contributors

juancito-dev

Issues