issues
search
sherlock-audit
/
2024-07-exactly-stacking-contracts-judging
3
stars
1
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Electric Holographic Albatross - Admin can disrupt reward distribution due to missing validation check in setProviderRatio()
#119
sherlock-admin4
closed
1 month ago
0
Rural Raspberry Cod - If the account has no assets, the function will revert
#118
sherlock-admin2
closed
1 month ago
0
Lively Ash Parakeet - In `_update` function `avgStart[to]` i.e `uint256 time` is updated to a monetary value.
#117
sherlock-admin3
closed
1 month ago
0
Short Olive Penguin - `notifyRewardAmount` calls `updateIndex()` twice, making the second update useless
#116
sherlock-admin4
closed
1 month ago
2
Sleepy Denim Cricket - `Market` and `StakedEXA` are non-compliant with ERC4626 standard
#115
sherlock-admin2
closed
1 month ago
0
Odd Opaque Fox - Redundant `updateIndex` Call in `notifyRewardAmount` Function
#114
sherlock-admin3
closed
1 month ago
0
Helpful Sapphire Zebra - missing UpdateIndex call in Claim and cliamALL
#113
sherlock-admin4
closed
1 month ago
0
Ancient Ash Lemur - `StakedEXA#permitAndDeposit()` can be bricked on the Eth mainnet
#112
sherlock-admin2
closed
1 month ago
0
Afriaudit - Early Return in Harvest Function Prevents Reward Distribution
#111
sherlock-admin4
closed
1 month ago
0
0uts1der - Potential Economic Loss in StakedEXA Due to Missing `harvest` in Key Functions
#110
sherlock-admin3
closed
1 month ago
1
rilwan99 - Attacker will lock victim funds in StakedEXA vault
#109
sherlock-admin2
closed
1 month ago
1
0xlucky - Attacker puts the amount of share token to be minted to a normal user/depositor in a vulnerable state .
#108
sherlock-admin4
closed
1 month ago
0
bareli - no check for market is listed
#107
sherlock-admin3
closed
1 month ago
1
Afriaudit - Inaccessible vault share After Changing Savings Address
#106
sherlock-admin2
closed
1 month ago
1
Ragnark_323 - Slippage Handling in permitAndDeposit Function
#105
sherlock-admin4
closed
1 month ago
1
Motomoto - Untracked reward penalty cuts in StakedEXA.sol
#104
sherlock-admin3
closed
1 month ago
1
blockchain555 - stEXA does not strictly comply with eip-20.
#103
sherlock-admin2
closed
1 month ago
0
Ragnark_323 - Floating Pragma in StakedEXA.sol and Importing FixedPointMathLib.sol with Vulnerable Solidity Versions
#102
sherlock-admin4
closed
1 month ago
1
0xBugHunter - In Emergency Situations, Users are Unable to Withdraw Their Assets (stEXA)
#101
sherlock-admin3
closed
1 month ago
0
Motomoto - Users can avoid penalty near refTime
#100
sherlock-admin2
closed
1 month ago
1
Ragnark_323 - No Storage Gap implemented for Upgradeable Contracts in StakedEXA.sol and Market.sol
#99
sherlock-admin4
closed
1 month ago
1
petro1912 - Any call to permit is front runnable, which will cause a DoS
#98
sherlock-admin3
closed
1 month ago
0
John_Femi - More funds will be lost by borrower on partial Liquidation
#97
sherlock-admin2
closed
1 month ago
1
0uts1der - Precision Loss in `notifyRewardAmount` Function Causes Unclaimable RewardToken
#96
sherlock-admin4
opened
1 month ago
2
bareli - use address(this) in place of "this"
#95
sherlock-admin3
closed
1 month ago
1
rilwan99 - Incorrect Discount Application will Reduce Rewards for Long-Term Stakers
#94
sherlock-admin2
closed
1 month ago
1
0x11singh99 - In modifier `permitSender` directly encoding `assets` dynamic array to calculate `hashStruct` is wrong according to `EIP712` specification.
#93
sherlock-admin4
closed
1 month ago
3
0xlexx2310 - Using transfer can cause the lost of funds
#92
sherlock-admin3
closed
1 month ago
1
mgf15 - no validation to ensure the arbitrum sequencer is down
#91
sherlock-admin2
closed
1 month ago
1
unRekt - In `harvest` function `amount` i.e a monetary value is compared with time, can lead to function failing frequently
#90
sherlock-admin4
closed
1 month ago
0
Afriaudit - function `notifyRewardAmount` in stakedEXA.sol incorrectly checks reward token balance in contract when when staked asset is same as reward token.
#89
sherlock-admin3
closed
1 month ago
3
mgf15 - Use of deprecated Chainlink function latestAnswer
#88
sherlock-admin2
closed
1 month ago
1
rilwan99 - Stakers will receive excessive rewards for durations beyond the reference staking period
#87
sherlock-admin4
closed
1 month ago
1
smbv-1923 - Griefing Attack while using `permitAndDeposit()`
#86
sherlock-admin3
closed
1 month ago
1
cholakov - `permitAndDeposit` is allowed to be called by the permit creator only
#85
sherlock-admin2
closed
4 weeks ago
14
smbv-1923 - Loss of user's fund via donation attack in `permitAndDeposit()`
#84
sherlock-admin4
closed
1 month ago
1
rilwan99 - The Market contract will have unlimited access to the StakedEXA contract's provider assets
#83
sherlock-admin3
closed
1 month ago
1
unRekt - `notifyRewardAmount` is logically incorrect which leads to incorrect calculation of `remainingRewards`
#82
sherlock-admin2
closed
1 month ago
1
Nyxaris - Multiple Reward Claims Exploitation in Single Block
#81
sherlock-admin4
closed
1 month ago
4
0xlexx2310 - The function baseRate will result in error if the x > EXP_TRESHOLD
#80
sherlock-admin3
closed
1 month ago
1
KupiaSec - In periods where `totalSupply = 0`, rewards will be locked forever in `StakeEXA` contract
#79
sherlock-admin2
closed
1 month ago
1
KupiaSec - Anyone could call `harvest()` to extend the period finish time
#78
sherlock-admin3
closed
1 month ago
1
sakshamguruji - While Claiming It Should Be Checked If rewardToken Is The Underlying Asset
#77
sherlock-admin3
closed
1 month ago
1
KupiaSec - A malicious attacker can make significant amount of reward token to be locked in `StakedEXA` by calling `harvest()` frequently
#76
sherlock-admin2
closed
1 month ago
0
Shubham - `notifyRewardAmount()` is not called after changing the `rewardData.duration` which leads to incorrect reward distribution
#75
sherlock-admin4
closed
1 month ago
1
0x73696d616f - Some bad debt will not be cleared when it should which will cause accrual of bad debt decreasing the protocol's solvency
#74
sherlock-admin2
opened
1 month ago
0
0x73696d616f - Liquidator will leave a pool with unassigned earnings on `Market::clearBadDebt()` free to claim for anyone when the repaid maturity is not the last
#73
sherlock-admin3
opened
1 month ago
4
cawfree - Stake Donation Evades Excess Staking Penalties
#72
sherlock-admin2
closed
1 month ago
1
eeyore - Incorrect `harvest()` function execution in a situation when `providerRatio == 0`.
#71
sherlock-admin4
closed
1 month ago
0
eeyore - Missing `approve()` in the `setMarket()` function will lead to a Denial of Service (DoS) in the `harvest()` function.
#70
sherlock-admin4
closed
1 month ago
0
Next