issues
search
sherlock-audit
/
2023-04-blueberry-judging
8
stars
5
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Ch_301 - user will not be able to close his position (run out of gas)
#105
sherlock-admin
closed
1 year ago
5
HonorLt - Repay and liquidate race after unpausing
#104
sherlock-admin
closed
1 year ago
0
helpMePlease - Potential flash loan vulnerability in `getPrice()` of `UniswapV2Oracle.sol`
#103
sherlock-admin
closed
1 year ago
0
Ch_301 - missing slippage protection
#102
sherlock-admin
closed
1 year ago
0
Ch_301 - attackers will keep stealing the `rewards` from Convex SPELL
#101
sherlock-admin
opened
1 year ago
7
Ch_301 - Attacker could steal all the `borrowBalance` from Aura SPELL
#100
sherlock-admin
closed
1 year ago
0
paweenpit - Fair Uniswap V3 LP price
#99
sherlock-admin
closed
1 year ago
0
Ch_301 - Aura SPELL is not compatible with Balancer pools
#98
sherlock-admin
closed
1 year ago
0
Ch_301 - `getPositionRisk()` will return a wrong value of risk
#97
sherlock-admin
opened
1 year ago
7
deadrxsezzz - Wrongfully assume token has 18 decimals
#96
sherlock-admin
closed
1 year ago
0
deadrxsezzz - Possible stale values from Chainlink oracle
#95
sherlock-admin
closed
1 year ago
0
helpMePlease - `ChainlinkAdapterOracle.sol` use BTC/USD chainlink oracle to price WBTC which is problematic if WBTC depegs
#94
sherlock-admin
closed
1 year ago
0
deadrxsezzz - ChainlinkAdapterOracle's getPrice() doesn't check if Arbitrum L2 sequencer is down
#93
sherlock-admin
closed
1 year ago
0
deadrxsezzz - If a token has primarySourceCount == 3, at least 2 valid prices should be given in order to get a price
#92
sherlock-admin
closed
1 year ago
0
helpMePlease - Chainlink's latestRoundData return stale or incorrect result
#91
sherlock-admin
closed
1 year ago
0
deadrxsezzz - Only 1 bank can be added to a certain token
#90
sherlock-admin
closed
1 year ago
0
deadrxsezzz - SoftVault doesn't implement the ISoftVault interface
#89
sherlock-admin
closed
1 year ago
0
0xepley - updatePool() and add() will not work properly for Arbitrum due to block.number
#88
sherlock-admin
closed
1 year ago
6
deadrxsezzz - onlyEOAEx() modifier can be bypassed
#87
sherlock-admin
closed
1 year ago
0
Bauchibred - Oracles being unpausable could breed more disadvantages than advantages
#86
sherlock-admin
closed
1 year ago
0
Bauchibred - TWAP period could be very low and potentially allow an attacker to influence this
#85
sherlock-admin
closed
1 year ago
0
Bauchibred - H IchiLpOracle can be easily manipulated due to the possibility of inflating the LP prices using the math provided in the function
#84
sherlock-admin
closed
1 year ago
0
Bauchibred - BlueBerryBank.borrow() is vulnerable to DOS attack, can easily be done when bank total debt is low.
#83
sherlock-admin
closed
1 year ago
0
Bauchibred - The Oracle data feed still lacks sufficient validation.
#82
sherlock-admin
closed
1 year ago
0
Bauchibred - Liquidation logic is still not completely correct
#81
sherlock-admin
closed
1 year ago
0
Bauchibred - LP tokens are stucked and not sent back to withdrawing user from the IchiSpell contract
#80
sherlock-admin
closed
1 year ago
0
Bauchibred - Incomplete integration for fee on transfer tokens since contract logic does not provide method for the complete debt size to be paid off
#79
sherlock-admin
closed
1 year ago
0
Bauchibred - Undesired behaviour of chainlink feeds when sequencer is down
#78
sherlock-admin
closed
1 year ago
0
Bauchibred - Potential DOS / lack of acccess to oracle price due to unhandled chainlink revert
#77
sherlock-admin
closed
1 year ago
1
PRAISE - openPositionFarm() doesn't check to make sure the pool gotten via the getPool() function is a valid and existing pool
#76
sherlock-admin
closed
1 year ago
0
Brenzee - No checks if Arbitrum sequencer is down in Chainlink feeds
#75
sherlock-admin
closed
1 year ago
0
J4de - All spell's `closePositionFarm` function can be attacked by sandwich attack
#74
sherlock-admin
closed
1 year ago
0
J4de - The `BlueBerryBank.sol#getPositionRisk` function calculates the risk unreasonably
#73
sherlock-admin
closed
1 year ago
0
J4de - `BlueBerryBank.sol#addBank` function can only be added but not deleted and the upper limit is fixed at 256
#72
sherlock-admin
closed
1 year ago
0
J4de - `WCurveGauge.sol#burn` function should use LP Token's decimals instead of `1e18`
#71
sherlock-admin
closed
1 year ago
0
J4de - `UniswapV3AdapterOracle.sol#setStablePools` function token check is incomplete
#70
sherlock-admin
closed
1 year ago
0
J4de - `ChainlinkAdapterOracle.sol#getPrice` function does not check `sequencerUptimeFeed`
#69
sherlock-admin
closed
1 year ago
0
J4de - `BalancePairOracal.sol#computeFairReserves` function does not consider the decimals
#68
sherlock-admin
closed
1 year ago
0
J4de - `BaseOracleExt.sol#_isValidPrices` should be divided by `minPrice` instead of `maxPrice`
#67
sherlock-admin
closed
1 year ago
0
0xepley - getPrice() doesn't check If Arbitrum sequencer is down in Chainlink feeds
#66
sherlock-admin
closed
1 year ago
0
Bauer - Lack of deadline for uniswap AMM
#65
sherlock-admin
closed
1 year ago
0
Bauer - Users can fail to closePositionFarm and lose their funds
#64
sherlock-admin
opened
1 year ago
2
PRAISE - there's no functionality provided by the protocol to unwhitelist whitelisted items incase
#63
sherlock-admin
closed
1 year ago
0
PRAISE - The return value of approve not checked
#62
sherlock-admin
closed
1 year ago
0
PRAISE - Lend() doesn't call approve before safeTransferFrom is used.
#61
sherlock-admin
closed
1 year ago
0
Breeje - Setting Deadline for `swapExactTokensForTokens` as `type(uint256).max` allows Exploits
#60
sherlock-admin
closed
1 year ago
0
Breeje - No Slippage Protection while removing liquidity from Curve Pool
#59
sherlock-admin
closed
1 year ago
0
Breeje - No Slippage Protection while Swapping tokens through uniswap router
#58
sherlock-admin
closed
1 year ago
0
tsvetanovv - Missing check for active Arbitrum Sequencer in `ChainlinkAdapterOracle.sol`
#57
sherlock-admin
closed
1 year ago
5
tsvetanovv - Price oracle could get a stale price
#56
sherlock-admin
closed
1 year ago
0
Previous
Next