sherlock-audit 2023-10-mzero-judging issues

sherlock-audit / 2023-10-mzero-judging

3 stars 2 forks source link

issues

Newest

Newest Most commented Recently updated Oldest Least commented Least recently updated

FastTiger - The user's 'buy' of the 'power token' may not have any effect on the user and may only cause damage to the user.

#82 sherlock-admin4 closed 5 months ago
0
w42d3n - Unsafe downcasting arithmetic operation in MinterGateway.sol:MinM()

#81 sherlock-admin3 closed 5 months ago
1
thisvishalsingh - `PowerToken::buy` can be frontrun

#80 sherlock-admin2 closed 5 months ago
2
fibonacci - If `updateCollateralInterval` is 0, minters are penalized for undercollateralization with each update

#79 sherlock-admin4 closed 5 months ago
2
FastTiger - The mint and burn function is vulnerable to Sandwitch Attack at `Minter Rate` update.

#78 sherlock-admin3 closed 5 months ago
6
FastTiger - The `MinterGateway.sol#_verifyvalidatorSignatures` function calculates `minTimestamp` incorrectly.

#77 sherlock-admin2 closed 5 months ago
16
FastTiger - Inconsistencies may arise in penalty calculations.

#76 sherlock-admin4 closed 5 months ago
1
w42d3n - Faulty Division Operations

#75 sherlock-admin3 closed 5 months ago
2
w42d3n - Using subtraction in an unchecked block may silently underflow

#74 sherlock-admin2 closed 5 months ago
2
kgothatso - missing modifier

#73 sherlock-admin4 closed 5 months ago
2
0xhashiman - Users can vote on proposals using flash loans

#72 sherlock-admin3 closed 5 months ago
2
0xhashiman - Wrong value of _votingPeriod

#71 sherlock-admin2 closed 5 months ago
3
0xhashiman - Quorum Value will always be 1

#70 sherlock-admin4 closed 5 months ago
2
kgothatso - infinite function can finish gas and cause DOS

#69 sherlock-admin3 closed 5 months ago
2
bareli - uncheck subtraction from "principalOfTotalActiveOwedM" and "_rawOwedM[[minter_]"

#68 sherlock-admin2 closed 5 months ago
1
xiaoming90 - Minter could mint M tokens without any Eligible Collateral

#67 sherlock-admin4 closed 5 months ago
2
xiaoming90 - A portion of the user's bootstrapped balance is lost

#66 sherlock-admin3 closed 5 months ago
13
xiaoming90 - Update Collateral Digest does not conform to EIP-712

#65 sherlock-admin2 closed 5 months ago
3
xiaoming90 - Users do not receive inflation if the delegatee is updated

#64 sherlock-admin4 closed 5 months ago
1
xiaoming90 - Minting can incur bad debt

#63 sherlock-admin3 closed 5 months ago
8
xiaoming90 - Inflation power tokens are lost after reset, and a portion of initial supply cannot be redeemed.

#62 sherlock-admin2 closed 5 months ago
0
xiaoming90 - Lack of nonce in the UpdateCollateralDigest

#61 sherlock-admin4 closed 5 months ago
0
xiaoming90 - Proposal fee of new cash token takes effect in the wrong epoch

#60 sherlock-admin3 closed 5 months ago
3
xiaoming90 - Users might receive worthless Power Tokens during the auction

#59 sherlock-admin2 closed 5 months ago
33
xiaoming90 - Lack of slippage control in buy order

#58 sherlock-admin4 closed 5 months ago
9
xiaoming90 - Multiple withdrawals

#57 sherlock-admin3 closed 5 months ago
4
xiaoming90 - Reset causes all state changes in the current epoch to be erased or rollback

#56 sherlock-admin2 closed 5 months ago
1
xiaoming90 - A different cash token pulled from the buyer wallet

#55 sherlock-admin4 closed 5 months ago
32
xiaoming90 - Using minimum timestamp across all signatures could drain the gateway

#54 sherlock-admin3 closed 5 months ago
1
xiaoming90 - Users unable to receive back the fee for their successful proposal

#53 sherlock-admin2 closed 5 months ago
1
xiaoming90 - Minter can retrieve collateral even if its account is underwater

#52 sherlock-admin4 closed 5 months ago
1
dany.armstrong90 - It may not be meaningful that the user buys the `Power Token`.

#51 sherlock-admin3 closed 5 months ago
0
dany.armstrong90 - The probability that proposers receive `Proposal Fee` may be reduced.

#50 sherlock-admin2 closed 5 months ago
0
KupiaSec - Incorrect penalty calculation for missing collateral updates

#49 sherlock-admin4 closed 5 months ago
1
lemonmon - The functions `MinterGateway._rate()` and `MToken._rate()` may return a rate value of 0 which may cause issues

#48 sherlock-admin3 closed 5 months ago
0
pkqs90 - No incentive for user to call `stopEarning` for M Tokens

#47 sherlock-admin2 closed 5 months ago
1
pkqs90 - Validator threshold can be bypassed: a single compromised validator can update minter's state to historical state

#46 sherlock-admin4 opened 5 months ago
4
pkqs90 - Malicious minters can repeatedly penalize their undercollateralized accounts in a short peroid of time, which can result in disfunctioning of critical protocol functions, such as `mintM`.

#45 sherlock-admin3 opened 5 months ago
6
pashap9990 - if someone participated in just one epoch it can claim reward for every epoch

#44 sherlock-admin2 closed 5 months ago
1
0xpiken - A proposer of `StandardGovernor` might end up paying a `proposalFee` greater than expected, possibly even in different token in some cases.

#43 sherlock-admin4 closed 5 months ago
5
pashap9990 - Cash token will be locked in epoch if no power token holder join to vote epoch

#42 sherlock-admin3 closed 5 months ago
1
coffiasd - The current rate should revert instead of returning a zero value

#41 sherlock-admin2 closed 5 months ago
1
0xpiken - The proposer of the `setProposalFee()` has a chance to retrieve their proposal fee after the RESET event, while others do not have this opportunity.

#40 sherlock-admin4 closed 5 months ago
4
Drynooo - Users could face hefty fines

#39 sherlock-admin3 closed 5 months ago
0
0xpiken - The sum of all voting power might be different from the sum of all power token balance due to the flaw of inflation mechanism

#38 sherlock-admin2 closed 5 months ago
28
0xpiken - A malicious user could cause the `M` Minter to incur more penalties by calling `burnM()`

#37 sherlock-admin4 closed 5 months ago
6
00001111x0 - `MinterGateway.updateCollateral()` signatures may be replayed to mint uncollateralized MToken in case of two collateral updates around the same time

#36 sherlock-admin3 closed 5 months ago
8
00001111x0 - Unapproved MToken earners can keep earning indefinitely, reducing yield for approved earners

#35 sherlock-admin2 closed 5 months ago
1
Ianoh - Vulnerability

#34 sherlock-admin4 closed 5 months ago
1
0xpiken - An earner can still continue earning even after being removed from the approved list.

#33 sherlock-admin3 opened 5 months ago
4