issues
search
code-423n4
/
2024-02-spectra-findings
4
stars
2
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Users can freely set ibtRate without depositing ibt or buying YT. They are assured of a risk-free instant yield when the ibtrate rises and they can potentially drain the entire contract balance with the use of flash loans.
#208
c4-bot-10
closed
8 months ago
7
Gas Optimizations
#207
c4-bot-2
opened
8 months ago
3
QA Report
#206
c4-bot-5
closed
8 months ago
3
QA Report
#205
c4-bot-5
closed
8 months ago
3
In line 229, `PrincipalToken::redeem` allows users to redeem assets without slippage protection
#204
c4-bot-6
closed
8 months ago
3
Gas Optimizations
#203
c4-bot-6
closed
8 months ago
4
QA Report
#202
c4-bot-8
closed
8 months ago
3
Incorrect rounding in `_convertIBTsToShares()`/`_convertSharesToIBTs()`, leading to minting more shares for the user than intended
#201
c4-bot-8
closed
8 months ago
5
Analysis
#200
c4-bot-9
closed
8 months ago
4
Invariant Violation: Discrepancy in PT and YT Token Supplies
#199
c4-bot-6
closed
8 months ago
3
Users may get Yield rewards less than they should
#198
c4-bot-6
opened
8 months ago
7
The ERC-5095 standard is not followed correctly
#197
c4-bot-10
closed
8 months ago
5
Analysis
#196
c4-bot-2
closed
8 months ago
3
Analysis
#195
c4-bot-4
opened
8 months ago
3
IBT rate manipulation exploits rounding, inflates user withdrawals.
#194
c4-bot-8
closed
8 months ago
5
Math precision issues risk unfair user profit margins.
#193
c4-bot-8
closed
8 months ago
4
Negative yield exploit allows PT rate manipulation, asset extraction.
#192
c4-bot-9
closed
8 months ago
4
Reentrancy allows double minting, inflating token supply, extracting value.
#191
c4-bot-3
closed
8 months ago
3
Overflows in calculations truncate user balances, causing substantial losses.
#190
c4-bot-3
closed
8 months ago
3
Unverified IBT vault rate leads to PT inflation, value extraction.
#189
c4-bot-9
closed
8 months ago
3
Lack of protection against repeated `_updatePTandIBTRates` calls allows attackers to arbitrarily drain PT rate.
#188
c4-bot-5
closed
8 months ago
5
Incorrect negative yield calculation in `_computeYield`
#187
c4-bot-4
closed
8 months ago
5
_getCurrentPTandIBTRates return err value of currentPTRate
#186
c4-bot-4
closed
8 months ago
1
Manipulation of the IBT rate could have serious implications for Spectra.
#185
c4-bot-9
closed
8 months ago
3
Lack of IBT amount verification enables arbitrage and theft.
#184
c4-bot-4
closed
8 months ago
4
The IBT's transfer and `transferFrom` functions altering balances that could manipulate Spectra's `ibtRate` calculation.
#183
c4-bot-7
closed
8 months ago
3
Analysis
#182
c4-bot-6
closed
8 months ago
2
Duration Paramter in Principle token can be exploited to cause IBT Rate Maniplulation and Gas Griefing
#181
c4-bot-6
closed
8 months ago
3
In line 206, `PrincipalToken::depositIBT` allows users to deposit without slippage protection
#180
c4-bot-8
closed
8 months ago
4
QA Report
#179
c4-bot-9
closed
8 months ago
6
Vaults where all shareholders redeemed their shares will suffer from the PT rate slash
#178
c4-bot-6
closed
8 months ago
5
Initialization Timeframe Vulnerability
#177
c4-bot-10
closed
8 months ago
3
Lack of chainID validation allows signatures to be re-used across forks
#176
c4-bot-2
closed
8 months ago
3
`PricipalToken::deposit() @ line 188` lacks implementation of transaction deadline
#175
c4-bot-3
closed
8 months ago
4
The main invariant that PT and its YT should have an equal supply at all times can be broken
#174
c4-bot-1
closed
8 months ago
3
Analysis
#173
c4-bot-4
opened
8 months ago
4
Analysis
#172
c4-bot-8
opened
8 months ago
2
Users withdraw excess PT, draining sustainability; long-term accounting inaccuracy.
#171
c4-bot-3
closed
8 months ago
3
Decimal mishandling drains assets, causing unintended long-term value loss.
#170
c4-bot-6
closed
8 months ago
4
IBT vault manipulation skews rate, enabling asset under-deposit.
#169
c4-bot-3
closed
8 months ago
3
PrincipalToken.sol is not fully EIP-5095 compliant
#168
c4-bot-2
closed
8 months ago
5
Pause feature misuse can lock funds, disrupt control flows.
#167
c4-bot-5
closed
8 months ago
3
If the underlying asset amount in the IBT changes outside of Spectra's control, it could lead to inaccuracies in the ibtRate tracking.
#166
c4-bot-7
closed
8 months ago
3
Vulnerability in _computeYield could lead to fund loss.
#165
c4-bot-3
closed
8 months ago
3
The PrincipalToken contract is potentially vulnerable to manipulated rate returns from the external IBT (ERC4626 vault).
#164
c4-bot-7
closed
8 months ago
3
Protocol may be incompatible with some OpenZeppelin ERC4626 based vaults
#163
c4-bot-2
closed
8 months ago
6
Non-Compliance of `PrincipalToken` with ERC5095
#162
c4-bot-8
closed
8 months ago
5
`PrincipalToken::claimYield()` will allow users to claim yield before `expiry/maturity`.
#161
c4-bot-8
closed
8 months ago
6
The consistent usage of ceiling rounding in `_computeTokenizationFee` Systematically overcharges users, enabling fund drainage with uncapped fees.
#160
c4-bot-9
closed
8 months ago
4
DAO controls critical functions, risking fund loss via role misuse.
#159
c4-bot-8
closed
8 months ago
3
Previous
Next