code-423n4 2024-03-pooltogether-findings issues

code-423n4 / 2024-03-pooltogether-findings

5 stars 4 forks source link

issues

Newest

Newest Most commented Recently updated Oldest Least commented Least recently updated

Upgraded Q -> 2 from #286 [1710926388866]

#360 c4-judge closed 4 months ago
6
Upgraded Q -> 2 from #346 [1710920189129]

#359 c4-judge closed 4 months ago
2
Upgraded Q -> 2 from #53 [1710767355136]

#357 c4-judge closed 4 months ago
3
Upgraded Q -> 2 from #350 [1710731009831]

#356 c4-judge closed 4 months ago
2
Upgraded Q -> 2 from #212 [1710490545380]

#355 c4-judge closed 4 months ago
3
Upgraded Q -> 2 from #292 [1710490528975]

#354 c4-judge closed 4 months ago
3
Slippage controls for calling `PrizeVault::deposit` and `PrizeVault::mint` functions are missing

#353 c4-bot-5 closed 4 months ago
4
Gas Optimizations

#352 c4-bot-6 opened 4 months ago
3
Loss of fund as gas fund by user if 0 shares is minted in the yieldvault

#351 c4-bot-3 closed 4 months ago
3
QA Report

#350 c4-bot-9 closed 4 months ago
3
A variable indicating the number of vaults in existence should be there in the factory contract.

#349 c4-bot-1 closed 4 months ago
4
The `claimYieldFeeShares` function will lose shares if `shares` != `yieldFeeBalance`

#348 c4-bot-7 closed 4 months ago
5
QA Report

#347 c4-bot-2 closed 4 months ago
3
QA Report

#346 c4-bot-6 opened 4 months ago
6
The winner can steal claimer fees, and force him to pay for the gas

#345 c4-bot-6 opened 4 months ago
15
Gas Optimizations

#344 c4-bot-2 closed 4 months ago
3
Gas Optimizations

#343 c4-bot-6 closed 4 months ago
3
Yield Fee Shares could be lost while claiming claimYieldFeeShares

#342 c4-bot-7 closed 4 months ago
4
Analysis

#341 c4-bot-10 opened 4 months ago
2
PrizeVault is incompatible with rebasing tokens

#340 c4-bot-8 closed 4 months ago
3
`PrizeVault` is not fully compliant with the ERC4626 standard

#339 c4-bot-2 closed 4 months ago
3
PrizeVault is not fully complient with EIP4626

#338 c4-bot-1 closed 4 months ago
4
The yield buffer acts as a constant margin against a proportional lossy deposit error

#337 c4-bot-3 closed 4 months ago
24
`_maxYieldVaultWithdraw()` uses `yieldVault.convertToAssets()`

#336 c4-bot-5 opened 4 months ago
16
`maxDeposit()` uses `yieldVault.maxDeposit()` but `_depositAndMint()` uses `yieldVault.mint()`

#335 c4-bot-10 opened 4 months ago
17
No written limitations on a total supply, that should not be higher than uint96max value

#334 c4-bot-5 closed 4 months ago
3
Dust sweeping may exceed yield vault deposit limit

#333 c4-bot-7 opened 4 months ago
11
`_withdraw()` may attempt to withdraw more than available

#332 c4-bot-7 opened 4 months ago
11
No asset buffer to account for withdrawal rounding errors

#331 c4-bot-10 closed 4 months ago
5
QA Report

#330 c4-bot-3 closed 4 months ago
3
Analysis

#329 c4-bot-5 closed 4 months ago
2
`claimYieldFeeShares()` sets `yieldFeeBalance = 0` instead of `yieldFeeBalance -= _shares`

#328 c4-bot-6 closed 4 months ago
4
QA Report

#327 c4-bot-5 closed 4 months ago
3
Gas Optimizations

#326 c4-bot-7 opened 4 months ago
6
QA Report

#325 c4-bot-7 closed 4 months ago
3
HookManager.sol allows users to set arbitrary hooks

#324 c4-bot-3 closed 4 months ago
8
claimYieldFeeShares rests yieldFeeBalance every time even if not all fees are claimed

#323 c4-bot-6 closed 4 months ago
5
No slippage protection when withdrawing and redeeming

#322 c4-bot-4 closed 4 months ago
5
Users can be eligable for prizes with little to no risk

#321 c4-bot-6 closed 4 months ago
4
`claimYieldFeeShares` decrements `yieldFeeBalance` by wrong amount

#320 c4-bot-3 closed 4 months ago
4
Yield fee is not accounted for during liquidation and therefore lost to the receiver in the `PrizeVault` contract

#319 c4-bot-10 closed 4 months ago
4
Incompatibility With Rebasing/Deflationary/Inflationary token

#318 c4-bot-10 closed 4 months ago
4
Gas Optimizations

#317 c4-bot-7 opened 4 months ago
6
Gas Optimizations

#316 c4-bot-2 opened 4 months ago
3
QA Report

#315 c4-bot-8 closed 4 months ago
3
`_yieldFee` wrongly rounded down in `PrizeVault:transferTokensOut`

#314 c4-bot-1 closed 4 months ago
4
Claiming yield fees may fully deplete the yield buffer and render the vault into a lossy state

#313 c4-bot-9 closed 4 months ago
4
the PriveVaultFactory doesn't transfer ownership to the msg.sender in the function deployVault

#312 c4-bot-2 closed 4 months ago
4
QA Report

#311 c4-bot-1 closed 4 months ago
3
`previewDeposit` and `previewMint` return incorrect value when total assets is less than total debt.

#310 c4-bot-10 closed 4 months ago
4