issues
search
sherlock-audit
/
2024-06-union-finance-update-2-judging
3
stars
2
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Cheesy Cinnabar Leopard - I-01 : Lacks of proper checks in `AssetManager :: withdraw` function makes the function more gas expensive.
#144
sherlock-admin4
closed
1 month ago
0
Quaint Golden Gecko - `LogBorrow`, `LogMint`, `LogRedeem`, `LogReservesReduced` report 18 dp instead of underlying dp amounts
#143
sherlock-admin2
closed
1 month ago
0
Acidic Eggplant Parakeet - Lack of Value Parameter Validation `value` with `msg.value`
#142
sherlock-admin3
closed
1 month ago
0
Stale Blood Iguana - Lack of Zero-Address Validation
#141
sherlock-admin4
closed
1 month ago
0
Rhythmic Bone Boa - Frontrunning permit to DoS `repayBorrowWithPermit()`
#140
sherlock-admin2
closed
1 month ago
3
Rare Mossy Okapi - Missing check before updating reserveFactorMantissa in Utoken.sol
#139
sherlock-admin3
closed
1 month ago
0
Acidic Eggplant Parakeet - Lack of Protection Against Self-Assignment of Pending Roles
#138
sherlock-admin4
closed
1 month ago
0
Sparkly Metal Koala - Comptroller initialize function should enforce halfDecayPoint to be greater than 0
#137
sherlock-admin2
closed
1 month ago
0
Rare Lipstick Cod - Repayments/Staking can easily be bricked
#136
sherlock-admin3
closed
1 month ago
0
0xpetern - An attacker can drain all funds in the protocol by taking over controller.sol because of insecure initialization.
#135
sherlock-admin2
closed
1 month ago
1
John_Femi - UToken failed to consider temporary depegging of USDC, USDT, DAI
#134
sherlock-admin4
closed
1 month ago
1
hyh - `updateLocked()` locks a rounded down value
#133
sherlock-admin3
opened
1 month ago
17
Bugvorus - `Comptroller::withdraw` function can be called by non-owner which leads to fund to get withdrawn without the owner intention
#132
sherlock-admin2
closed
1 month ago
1
0xlucky - repayBorrowWithERC20Permit() function can be griefed by attacker and user will not be able to repay the borrow funds
#131
sherlock-admin4
closed
1 month ago
0
KungFuPanda - The UserManager contract is incompatible with USDT
#130
sherlock-admin3
closed
1 month ago
1
cryptphi - No access control on ERC1155Voucher::onERC1155BatchReceived()
#129
sherlock-admin2
closed
1 month ago
0
MohammedRizwan - Incorrect value `BORROW_RATE_MAX_MANTISSA` used in contracts
#128
sherlock-admin4
closed
1 month ago
9
smbv-1923 - Unsafe downcasting arithmetic operation in `VouchFaucet.sol`
#127
sherlock-admin3
closed
1 month ago
1
hyh - UserManager's `debtWriteOff()` updates `_totalStaked` incorrectly
#126
sherlock-admin2
closed
1 month ago
0
korok - Arbitrary ERC1155 Token Transfer Grants Unintended Trust in ERC1155Voucher Contract
#125
sherlock-admin4
closed
1 month ago
0
Bugvorus - H-2: VouchFacet::claimTokens lacks to update the state after operation causes caller to claim token much more than they should.
#124
sherlock-admin3
closed
1 month ago
0
hyh - `repayBorrowWithERC20Permit()` functions use incorrectly scaled accumulated interest value
#123
sherlock-admin2
closed
1 month ago
0
hyh - UToken amount to be burned on redeem can be less than the corresponding amount withdrawn
#122
sherlock-admin4
closed
1 month ago
19
Bugvorus - Issue H-1: VouchFacet::claimTokens missing validation checks for amount causing caller to claim more token that they actually own.
#121
sherlock-admin2
closed
1 month ago
1
Bugvorus - `VouchFacet::claimTokens` missing validation checks for amount causing caller to claim more token that they actually own.
#120
sherlock-admin4
closed
1 month ago
1
smbv-1923 - Share inflation attack while depositing tokens and minting Utoken in `UToken.sol::mint()`
#119
sherlock-admin3
closed
1 month ago
1
0xCO2 - Incompatibility With Fee-on-Transfer Tokens
#118
sherlock-admin2
closed
1 month ago
1
0xAadi - NatSpec Comment is not strictly followed: `setInterestRate` Allows Setting Rate Equal to Maximum Limit
#117
sherlock-admin4
closed
1 month ago
1
smbv-1923 - Use a safe transfer helper library for ERC20 transfers
#116
sherlock-admin3
closed
1 month ago
0
0xJoyBoy03 - any stakers who lent to borrowers can increase their rewards by a portion repayment
#115
sherlock-admin2
closed
1 month ago
15
hyh - Minimum borrow amount can be surpassed and borrower can be treated as being overdue earlier than their actual overdue time
#114
sherlock-admin4
opened
1 month ago
3
0xAadi - `onERC1155Received` and `onERC1155BatchReceived` Not Considering `value`, `values` and `ids` Parameters while performing ERC1155 deposits
#113
sherlock-admin3
closed
1 month ago
1
smbv-1923 - DOS attack while using `repayBorrowWithPermit()`
#112
sherlock-admin2
closed
1 month ago
0
0xAadi - Missing Token Validity Check in `onERC1155BatchReceived` in `ERC1155Voucher` contract
#111
sherlock-admin4
closed
1 month ago
0
hyh - `exchangeRateStored()` decimals are incorrect and misaligned with `exchangeRateCurrent()`
#110
sherlock-admin3
closed
1 month ago
3
Bigsam - Function Rebalance can deposit above Moneymarket ceiling
#109
sherlock-admin2
closed
1 month ago
10
Varun_05 - _accrueRewards function in Comptroller.sol uses outdated value of globalTotalStaked variable.
#108
sherlock-admin4
closed
1 month ago
0
0xAadi - Lack of Whitelisting Mechanism in VouchFaucet Contract
#107
sherlock-admin3
closed
1 month ago
1
CFSecurity - If there are no assets available during deposit, the user will receive fewer tokens than they deserve when withdrawing
#106
sherlock-admin2
closed
1 month ago
13
KungFuPanda - The _totalStaked tracker calculation is incorrect and will be inflated due to the improper logic in the writeOffDebt function of the UserManager contract, leading to wrong Comptroller gInflationIndex being calculated and wrong user rewards being issued
#105
sherlock-admin4
opened
1 month ago
2
trachev - `UToken.sol`'s `redeem` function rounds against the protocol
#104
sherlock-admin3
closed
1 month ago
1
cryptphi - No initialiazation of state variable claimedTokens
#103
sherlock-admin2
closed
1 month ago
0
trachev - Any user can claim an unlimited amount of vouch in `VouchFaucet.sol`
#102
sherlock-admin4
opened
1 month ago
19
cryptphi - Users can double claim in claimTokens()
#101
sherlock-admin3
closed
1 month ago
0
cryptphi - User without claimable token in VouchFaucet contract can claim
#100
sherlock-admin2
closed
1 month ago
1
Varun_05 - Wrong check used in claimTokens function in vouchFacet contract.
#99
sherlock-admin4
closed
1 month ago
0
Bigsam - Current Implementation of deposit in Assetmanager.sol fails to iletarate to fill floor in the moneymarket and instead deposits all into one moneymarket
#98
sherlock-admin3
closed
1 month ago
9
Varun_05 - In vouchFaucet value of claimedTokens[token][msg.sender] is never set.
#97
sherlock-admin2
closed
1 month ago
0
CFSecurity - Malicious user can steal all the funds in the `VouchFaucet` contract
#96
sherlock-admin4
closed
4 weeks ago
41
trachev - All tokens can be stolen from `VouchFaucet.sol`
#95
sherlock-admin3
closed
1 month ago
0
Next