issues
search
code-423n4
/
2024-02-wise-lending-findings
11
stars
8
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Same address set for Curve and Uniswap
#210
c4-bot-7
closed
5 months ago
5
``blockReservePublic()`` does not block public reservation, only third-party
#209
c4-bot-7
closed
5 months ago
4
MAX_COLLATERAL_FACTOR not checked in WiseLending and PendlePowerFarm
#208
c4-bot-6
closed
5 months ago
7
Chainlink oracle upgrade may cause DOS for some tokens in the protocol
#207
c4-bot-1
closed
5 months ago
3
QA Report
#206
c4-bot-10
closed
5 months ago
2
Gas Optimizations
#205
c4-bot-10
closed
5 months ago
2
`FeeManager::totalBadDebtETH` variable manipulation can prevent incentive distribution to owner A and B and DoS `claimFeesBeneficial`
#204
c4-bot-6
closed
5 months ago
3
onERC721Received callback is never called when new tokens are minted.
#203
c4-bot-10
closed
5 months ago
4
Liquidating chaining can be achieved by liquidating token collateral with the highest `collateralFactor`
#202
c4-bot-6
opened
5 months ago
8
A token quickly losing value will block liquidations
#201
c4-bot-5
closed
5 months ago
3
Fees will be lost when operations are executed often
#200
c4-bot-5
closed
5 months ago
9
Ether sent to `PendlePowerManager` will be lost forever
#199
c4-bot-8
closed
5 months ago
7
2.5% price discrepancy combined with chainlink price feeds deviation threshold can often lead to DoS of pools
#198
c4-bot-8
closed
5 months ago
3
Total bad debts are overstated and can affect access and distribution of benefits
#197
c4-bot-8
closed
5 months ago
11
Validity checks in `OracleHelper#_validateAnswer` are not sufficient and the function can return a stale price
#196
c4-bot-9
closed
5 months ago
3
Permanent DoS of price oracle, upon updates to Chainlink's aggregators .
#195
c4-bot-4
closed
5 months ago
7
QA Report
#194
c4-bot-1
closed
5 months ago
2
The Fee Manager NFT Shares can be drained
#193
c4-bot-9
closed
5 months ago
6
The position of the aaveHub can be liquidate if aave contract is in pause
#192
c4-bot-1
closed
5 months ago
5
The first deposit of each pool token will revert
#191
c4-bot-5
closed
5 months ago
4
Gas Optimizations
#190
c4-bot-4
closed
5 months ago
2
Not enforcing full liquidation accrues bad debt in the system
#189
c4-bot-3
closed
5 months ago
3
QA Report
#188
c4-bot-3
closed
5 months ago
2
QA Report
#187
c4-bot-4
opened
5 months ago
6
Gas Optimizations
#186
c4-bot-2
closed
5 months ago
2
User can DoS liquidations for extended period of time
#185
c4-bot-4
closed
5 months ago
5
setAaveTokensBulk misses one token while setting Token addresses
#184
c4-bot-1
closed
5 months ago
1
Malicious users can honeypot other users by withdrawing deposit tokens
#183
c4-bot-3
closed
5 months ago
3
OracleHelper.getEthPriceInUSD does not consider arbitrum sequencer uptime when validating chainlink answer.
#182
c4-bot-3
closed
5 months ago
9
Analysis
#181
c4-bot-3
closed
5 months ago
2
Security breaches in Aave or Pendle Power Farms may lead to Wise Lending asset loss.
#180
c4-bot-8
closed
5 months ago
4
Users may lose assets with drained liquidity, impacting borrowing and withdrawal functionality.
#179
c4-bot-10
closed
5 months ago
4
`_validateAnswer` function inadequate for detecting manipulation attempts.
#178
c4-bot-8
closed
5 months ago
3
Analysis
#177
c4-bot-5
closed
5 months ago
4
Oracle Updates can be sandwiched to liquidate own positions
#176
c4-bot-3
closed
5 months ago
3
Infinite approvals to third parties are irrevokable and subject to be the soft belly when the dependent platform is exploited
#175
c4-bot-5
closed
5 months ago
4
Validation of chainlink answer may use stale price
#174
c4-bot-2
closed
5 months ago
3
Hardcoded prices are prone to be abused one day
#173
c4-bot-8
closed
5 months ago
4
Initialization of PendlePowerFarmToken can be frontrun leading to DOS.
#172
c4-bot-8
closed
5 months ago
1
Liquidation will DoS in case of tokens with blacklist properties
#171
c4-bot-8
closed
5 months ago
4
Attacker can theft almost all users that enter the farms by abusing zero id
#170
c4-bot-7
closed
5 months ago
5
Assigning available NFTs in PendlePowerManager leads to position thefts
#169
c4-bot-7
closed
5 months ago
4
No error handling and fallback feeds for Chainlink oracle calls in Pendle wrappers
#168
c4-bot-7
closed
5 months ago
4
Analysis
#167
c4-bot-6
closed
5 months ago
2
PendlePowerManager and AaveHUb don´t forward the received ETH to the master address as intended
#166
c4-bot-7
closed
5 months ago
6
The protocol is not ready for Position Transfers as declared
#165
c4-bot-7
closed
5 months ago
3
Unsafe casting of Chainlink data feed answers
#164
c4-bot-1
closed
5 months ago
5
Using Uniswap TWAP on L2 leads to DoS
#163
c4-bot-7
closed
5 months ago
2
QA Report
#162
c4-bot-9
closed
5 months ago
2
Liquidation with zero shares
#161
c4-bot-9
closed
5 months ago
6
Previous
Next