issues
search
code-423n4
/
2024-02-spectra-findings
4
stars
2
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Malicious IBTs could corrupt ibtRate if Spectra solely relies on the IBT's state
#158
c4-bot-8
closed
8 months ago
3
Lack of state synchronization allows IBT manipulation.
#157
c4-bot-9
closed
8 months ago
3
ERC777 token usage in deposit function allows reentrancy attack.
#156
c4-bot-6
closed
8 months ago
3
A non-standard ERC4626 vault could cause significant issues for Spectra.
#155
c4-bot-7
closed
8 months ago
3
Exchange rate can be manipulated with Flashloans
#154
c4-bot-3
closed
8 months ago
3
No check for Flashlender sending back the tokens
#153
c4-bot-7
closed
8 months ago
3
In line 176, `PrincipalToken::deposit` allows users to deposit without slippage protection
#152
c4-bot-5
closed
8 months ago
4
Direct Transfer of IBT Tokens Not Reflected in totalAssets
#151
c4-bot-1
closed
8 months ago
3
PrincipalToken.sol is not EIP-5095 compliant
#150
c4-bot-8
closed
8 months ago
5
The EIP-5095 standard is not followed correctly.
#149
c4-bot-5
closed
8 months ago
5
The `PrincipalToken::updateYield` function lacks access control, which could result in arbitrary users being able to update their IBT yield.
#148
c4-bot-6
closed
8 months ago
4
PrincipalToken is incompatible with ERC-5095
#147
c4-bot-2
closed
8 months ago
6
QA Report
#146
c4-bot-2
opened
8 months ago
2
`updateYield()` can protocol invariant
#145
c4-bot-5
closed
8 months ago
4
upgradeToAndCall should check if callee is a contract
#144
c4-bot-3
closed
8 months ago
3
Malicious Users Can Drain The Assets Of Vault. (Due to not being ERC4626 Complaint)
#143
c4-bot-2
closed
8 months ago
3
QA Report
#142
c4-bot-3
closed
8 months ago
3
Analysis
#141
c4-bot-2
closed
8 months ago
2
Gas Optimizations
#140
c4-bot-1
closed
8 months ago
2
IBT Vault (ERC4626) hack prevention is not sufficient
#139
c4-bot-8
closed
8 months ago
5
QA Report
#138
c4-bot-6
closed
8 months ago
3
QA Report
#137
c4-bot-3
opened
8 months ago
2
`withdraw()` and `withdrawIBT()` rounds in incorrect direction
#136
c4-bot-1
closed
8 months ago
5
Gas Optimizations
#135
c4-bot-1
closed
8 months ago
3
`convertToPrincipal()` and `previewWithdraw()` have got inconsistent implementation which violates EIP-5095
#134
c4-bot-10
closed
8 months ago
8
`maxRedeem` implementation is not EIP-5095 compliant
#133
c4-bot-3
closed
8 months ago
4
Function `claimFees()` can be called even when contrac is paused
#132
c4-bot-10
closed
8 months ago
3
`withdraw()` does not decrease the allowance
#131
c4-bot-7
closed
8 months ago
3
Incorrect maturity calculations for YieldToken
#130
c4-bot-2
closed
8 months ago
5
Incorrect burning mechanism in `_beforeRedeem()`
#129
c4-bot-2
closed
8 months ago
4
`maxWithdraw` implementation is not EIP-5095 compliant
#128
c4-bot-7
closed
8 months ago
5
`_convertIBTsToSharesPreview()` rounds in the wrong direction
#127
c4-bot-8
closed
8 months ago
3
`beforeYtTransfer()` not used before yield transfer
#126
c4-bot-2
closed
8 months ago
3
Function `updateYield()` can be called by anyone
#125
c4-bot-3
closed
8 months ago
4
TokenizedFee is not applied as expected with the user's discount fee.
#124
c4-bot-4
closed
8 months ago
4
FlashLoan logic do not control the end result of transferring tokens out and back in.
#123
c4-bot-1
closed
8 months ago
4
PrincipalToken.sol:: deposit() with any asset does not account fee-on-transfer token
#122
c4-bot-6
closed
8 months ago
3
QA Report
#121
c4-bot-9
closed
8 months ago
7
Potential incorrect and inconsistent yield computation
#120
c4-bot-1
closed
8 months ago
4
Gas Optimizations
#119
c4-bot-2
closed
8 months ago
2
maxWithdraw() will revert when paused but should return 0 instead
#118
c4-bot-4
closed
8 months ago
5
Gas Optimizations
#117
c4-bot-2
closed
8 months ago
2
maxRedeem() should return 0 when redemptions are paused
#116
c4-bot-9
closed
8 months ago
4
PrincipalToken.sol is not EIP-5095 compliant
#115
c4-bot-1
closed
8 months ago
4
Any user can broke the `PT supply == YT supply` invariant
#114
c4-bot-2
closed
8 months ago
8
Griefing ERC3156FlashBorrower by calling flashloan on his behalf
#113
c4-bot-2
closed
8 months ago
10
QA Report
#112
c4-bot-7
opened
8 months ago
6
All yield generated in the IBT vault can be drained by performing a vault deflation attack using the flash loan functionality of the Principal Token contract
#111
c4-bot-9
opened
8 months ago
7
Protocol may not work well with pausable underlying assets or ibts token vault that can pause transfers
#110
c4-bot-5
closed
8 months ago
3
The claimed yield of a user is impacted by other users' activity and the yield computation could be inconsistent.
#109
c4-bot-8
closed
8 months ago
7
Previous
Next