code-423n4 2022-01-sandclock-findings issues

code-423n4 / 2022-01-sandclock-findings

0 stars 0 forks source link

issues

Newest

Newest Most commented Recently updated Oldest Least commented Least recently updated

Withdrawals cause higher risk

#194 code423n4 closed 2 years ago
2
Hard to collect fee

#193 code423n4 closed 2 years ago
1
Incorrect share accounting

#192 code423n4 closed 2 years ago
3
Race condition to withdraw funds

#191 code423n4 closed 2 years ago
3
Misdefinition of _minLockPeriod will lock funds indefinitely

#190 code423n4 closed 2 years ago
2
Authorities can grief with fees

#189 code423n4 closed 2 years ago
1
Function spec is wrong (copy paste issue)

#188 code423n4 closed 2 years ago
1
No input check : claim.pct = 0

#187 code423n4 closed 2 years ago
1
Lack of input check in deposit amount

#186 code423n4 closed 2 years ago
2
Missing slippage/min-return check in the `curve Pool`

#185 code423n4 closed 2 years ago
1
Missing Re-entrancy Guard

#184 code423n4 closed 2 years ago
2
Check _to is not empty

#183 code423n4 closed 2 years ago
2
`BaseStrategy:perfFeePct` can be 100%

#182 code423n4 closed 2 years ago
2
Unsafe mint is a reentrancy door

#181 code423n4 closed 2 years ago
1
Unclear require statement

#180 code423n4 closed 2 years ago
2
Incompatibility With Rebasing/Deflationary/Inflationary tokens

#179 code423n4 closed 2 years ago
3
Add a timelock to `BaseStrategy:setPerfFeePct`

#178 code423n4 closed 2 years ago
2
A precision loss when creating deposits

#177 code423n4 closed 2 years ago
1
Slippage protection

#176 code423n4 closed 2 years ago
1
_lockedUntil is not deterministic and does not have an upper boundary

#175 code423n4 closed 2 years ago
0
Open TODOs in Codebase

#174 code423n4 closed 2 years ago
2
Strategy could have a pausing mechanism

#173 code423n4 closed 2 years ago
1
Improper Upper Bound Definition on the Fee

#172 code423n4 closed 2 years ago
4
Open TODOs

#171 code423n4 closed 2 years ago
2
forgot to remove a TODO comment.

#170 code423n4 closed 2 years ago
1
forgot to remove TODO comment

#169 code423n4 closed 2 years ago
2
[WP-H12] `forceUnsponsor()` may open a window for attackers to manipulate the `_totalShares` and freeze users' funds at a certain deposit amount

#168 code423n4 closed 2 years ago
4
[WP-L11] `_createDeposit()` `_lockedUntil` should be upper-bounded

#167 code423n4 closed 2 years ago
2
[WP-H10] A malicious early user/attacker can manipulate the pps to freeze users' funds at a certain deposit amount

#166 code423n4 closed 2 years ago
1
[WP-H9] Centralization Risk: Funds can be frozen when critical key holders lose access to their keys

#165 code423n4 closed 2 years ago
2
[WP-M8] `totalUnderlyingMinusSponsored()` may revert on underflow and malfunction the contract

#164 code423n4 closed 2 years ago
0
[WP-N7] `Vault.sol` Tokens with fee on transfer are not supported

#163 code423n4 closed 2 years ago
2
[WP-L6] Critical operations should emit events

#162 code423n4 closed 2 years ago
5
[WP-L5] Use of deprecated `safeApprove`

#161 code423n4 closed 2 years ago
2
[WP-M4] `NonUSTStrategy.sol` Lack of slippage control

#160 code423n4 closed 2 years ago
1
[WP-H3] `NonUSTStrategy.sol` A malicious user/attacker can game the system by `claimYield()` or `withdraw()` based on price changes

#159 code423n4 closed 2 years ago
3
[WP-H2] `NonUSTStrategy.sol` Improper handling of swap fees allows attacker to steal funds from other users

#158 code423n4 closed 2 years ago
3
[WP-M1] `withdraw()` transactions can often fail

#157 code423n4 closed 2 years ago
3
[WP-H0] Late users will take more losses than expected when the underlying contract (`EthAnchor`) suffers investment losses

#156 code423n4 closed 2 years ago
2
Prevent deposit and sponsor for value of 0 amount

#155 code423n4 closed 2 years ago
1
User facing and asset bearing Vault and BaseStrategy contracts miss emergency lever

#154 code423n4 closed 2 years ago
2
Vault: Spelling Error in comment

#153 code423n4 closed 2 years ago
1
NonUSTStrategy: Ensure correct UST index

#152 code423n4 closed 2 years ago
1
NonUSTStrategy: Ensure correct underlying index

#151 code423n4 closed 2 years ago
1
Medium: Consider alternative price feed + ensure _minLockPeriod > 0 to prevent flash loan attacks

#150 code423n4 closed 2 years ago
2
Vault: Reduce reliance on manual rebalances from strategy to vault

#149 code423n4 closed 2 years ago
1
Vault: onDepositBurn() causes users to unfairly have their deposits allocated as yield

#148 code423n4 closed 2 years ago
1
Vault: onDepositMinted() reentrancy causes users’ deposits to be erroneously accounted as yield

#147 code423n4 closed 2 years ago
1
first user in the system can steal all incoming assets

#146 code423n4 closed 2 years ago
4
`Vault.sponsor()` Does Not Prevent Sponsoring The Zero Amount

#145 code423n4 closed 2 years ago
1