issues
search
code-423n4
/
2024-05-loop-findings
4
stars
4
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Lack of Token De-listing Functionality
#86
howlbot-integration[bot]
closed
3 months ago
3
Tokens cannot be disallowed nnce allowed
#85
howlbot-integration[bot]
closed
3 months ago
3
Missing Token Removal Functionality
#84
howlbot-integration[bot]
closed
3 months ago
3
Users can bypass checks for `inputToken` and `outputToken` in `_validateData()` because of the wrong RLP decoder implementation
#83
howlbot-integration[bot]
closed
3 months ago
4
Unexpected Gains at the Expense of Users Who Sent ETH by Mistake
#82
howlbot-integration[bot]
closed
3 months ago
9
Claims that are not paused during `emergencymode` can cause users to get more `lpETH` than the amount of `ETH` they have locked
#81
howlbot-integration[bot]
closed
3 months ago
3
Incorrect Parsing Of UniswapV3's Token Path
#80
howlbot-integration[bot]
closed
3 months ago
4
Permanent token whitelisting in protocol poses exploitation risks
#79
howlbot-integration[bot]
closed
3 months ago
4
[M-01] After global conversion is done using `PrelaunchPoints::convertAllETH` and emergency mode is activated, LRT lockers will be able to withdraw their staked principal LRTs but ETH/WETH lockers will not be able to withdraw.
#78
howlbot-integration[bot]
closed
3 months ago
4
The `withdraw()` function forces users to claim `lpETH` even in emergency mode
#77
howlbot-integration[bot]
closed
3 months ago
3
Insufficient Validation of _validateData funcion
#76
howlbot-integration[bot]
closed
3 months ago
3
Rebase tokens amounts can change during the lock time and till the claim date
#75
howlbot-integration[bot]
closed
3 months ago
5
Loss of funds for users who claim vested `lpETH` by swapping via `UniswapV3`
#74
howlbot-integration[bot]
closed
3 months ago
2
Any user can bypass the conversion of LRTs to lpETH during the claim process by deploying custom pools on Uniswap
#73
howlbot-integration[bot]
closed
3 months ago
4
Incorrect ETH Handling in Claim Function of PrelaunchPoints Contract When `_token != ETH`
#72
howlbot-integration[bot]
closed
3 months ago
7
Users can bypass the conversion of LRT to lpETH by setting a feeRecipient in the 0x transaction
#71
howlbot-integration[bot]
closed
3 months ago
4
Incorrect Handling of Contract's ETH Balance in _claim Function
#70
howlbot-integration[bot]
closed
3 months ago
8
User can Claim Entire Eth Balance of Contract instead of just their own Eth Claim Value
#69
howlbot-integration[bot]
closed
3 months ago
10
Excess ETH (Protocol Fee Refund) Not Returned to User in _fillQuote Function
#68
howlbot-integration[bot]
closed
3 months ago
3
after `_fillQuote` the contract transfer wrong `ETH` amount
#67
howlbot-integration[bot]
closed
3 months ago
11
Users are able to withdraw their LRT tokens 7 days after loopActivation is set and earn points without swapping their `LRT` for `lpETH`
#66
howlbot-integration[bot]
closed
3 months ago
5
User Balance Overdeduction Due to incomplete swap of inputTokenAmount in the UniswapV3 pool resulting in loss of funds to users in edge case
#65
howlbot-integration[bot]
closed
3 months ago
4
Incorrect Handling of ETH Balance Post-Swap in _claim Function Leading to lpETH Over/Under-Minting
#64
howlbot-integration[bot]
closed
3 months ago
14
Attacker can bypass lock to claim any number of token they wanted
#63
howlbot-integration[bot]
closed
3 months ago
3
Malicious users can steal their locked LRT back by inserting their own token as an intermediary
#62
howlbot-integration[bot]
closed
3 months ago
5
Persistent malicious or faulty tokens due to the lack of functionality to disallow tokens
#61
howlbot-integration[bot]
closed
3 months ago
3
User assets frozen indefinetely due to lack of function to rescue preapproved tokens that turn out to be faulty
#60
howlbot-integration[bot]
closed
3 months ago
5
Mismatch in Total Supply and Total lpETH Due to WETH Conversion
#59
howlbot-integration[bot]
closed
3 months ago
4
Users could claim any amount of `lpETH` without locking a corresponding amount of tokens
#58
howlbot-integration[bot]
closed
3 months ago
3
Claim and stake more than initially locked
#57
howlbot-integration[bot]
closed
3 months ago
17
User can skip locking mechanism funnelling in ether deposits to mint `lpETH` when the time deemed to do so is long past
#56
howlbot-integration[bot]
closed
3 months ago
4
Potential Over-Issuance of lpETH Due to Unaccounted ETH Deposits Before Claim and Stake Operations
#55
howlbot-integration[bot]
closed
3 months ago
14
The locked ETH balance can be used in the `_claim` function
#54
howlbot-integration[bot]
closed
3 months ago
9
Users can claim as much lpETH as they want as long as they have LRT token deposited
#53
howlbot-integration[bot]
closed
3 months ago
3
Break in Main invariants : Report on Distortion of LPETH to ETH Conversion Ratio
#52
howlbot-integration[bot]
closed
3 months ago
6
Report on Incorrect Assumption in Contract Functionality giving users more LPETH THAN THEIR SWAPPED AMOUNT
#51
howlbot-integration[bot]
closed
3 months ago
8
Proper handling of Eth in Convert all function to maintain 1:1 ratio between total supply of eth and lpeth
#50
howlbot-integration[bot]
closed
3 months ago
8
Race condition on `PrelaunchPoints::_claim()` allow malicious actor deposit all other user `ETH` to `lpETHVault` to get `lpETH` more than they should be
#49
howlbot-integration[bot]
closed
3 months ago
2
User can game rewarding system siphoning rewards for themselves at a huge margin to other stakers when it shouldn't be possible
#48
howlbot-integration[bot]
closed
3 months ago
7
Staking users can emit any valued Claimed and StakedVault events, which may disrupt point calculation.
#47
howlbot-integration[bot]
closed
3 months ago
20
Users can receive more lpETH than their locked ETH allows them
#46
howlbot-integration[bot]
closed
3 months ago
3
An attacker can swap all ETH in the contract to lpETH
#45
howlbot-integration[bot]
closed
3 months ago
3
User may claim more LpETH due to ETH being mistakenly sent to the contract
#44
howlbot-integration[bot]
closed
3 months ago
9
Direct ETH transfer to the protocol will break one of its main invariants
#43
howlbot-integration[bot]
closed
3 months ago
6
Malicious actors could exploit `claim()` function to get lpETH at a discount
#42
howlbot-integration[bot]
closed
3 months ago
3
Invariant is broken, one ETH deposit by user is not convertable to one lpETH, if someone manually deposits eth to contract
#41
howlbot-integration[bot]
closed
3 months ago
7
Users can still "deposit" in order to mint more `lpETH` than they have locked during the lock-up period
#40
howlbot-integration[bot]
closed
3 months ago
3
The `_claim()` function `claimedAmount` calculations causes the `lpETH` to `ETH` conversion rate inflate and not equal 1:1
#39
howlbot-integration[bot]
closed
3 months ago
7
It's possible for an user to lock and get more lpETH even after `loopActivation` timestamp
#38
howlbot-integration[bot]
closed
3 months ago
3
Malicious users could bypass the lock process to claim any amount of lpETH
#37
howlbot-integration[bot]
closed
3 months ago
4
Previous
Next