sherlock-audit 2024-07-exactly-stacking-contracts-judging issues

sherlock-audit / 2024-07-exactly-stacking-contracts-judging

3 stars 1 forks source link

issues

Newest

Newest Most commented Recently updated Oldest Least commented Least recently updated

Electric Holographic Albatross - Admin can disrupt reward distribution due to missing validation check in setProviderRatio()

#119 sherlock-admin4 closed 1 month ago
0
Rural Raspberry Cod - If the account has no assets, the function will revert

#118 sherlock-admin2 closed 1 month ago
0
Lively Ash Parakeet - In `_update` function `avgStart[to]` i.e `uint256 time` is updated to a monetary value.

#117 sherlock-admin3 closed 1 month ago
0
Short Olive Penguin - `notifyRewardAmount` calls `updateIndex()` twice, making the second update useless

#116 sherlock-admin4 closed 1 month ago
2
Sleepy Denim Cricket - `Market` and `StakedEXA` are non-compliant with ERC4626 standard

#115 sherlock-admin2 closed 1 month ago
0
Odd Opaque Fox - Redundant `updateIndex` Call in `notifyRewardAmount` Function

#114 sherlock-admin3 closed 1 month ago
0
Helpful Sapphire Zebra - missing UpdateIndex call in Claim and cliamALL

#113 sherlock-admin4 closed 1 month ago
0
Ancient Ash Lemur - `StakedEXA#permitAndDeposit()` can be bricked on the Eth mainnet

#112 sherlock-admin2 closed 1 month ago
0
Afriaudit - Early Return in Harvest Function Prevents Reward Distribution

#111 sherlock-admin4 closed 1 month ago
0
0uts1der - Potential Economic Loss in StakedEXA Due to Missing `harvest` in Key Functions

#110 sherlock-admin3 closed 1 month ago
1
rilwan99 - Attacker will lock victim funds in StakedEXA vault

#109 sherlock-admin2 closed 1 month ago
1
0xlucky - Attacker puts the amount of share token to be minted to a normal user/depositor in a vulnerable state .

#108 sherlock-admin4 closed 1 month ago
0
bareli - no check for market is listed

#107 sherlock-admin3 closed 1 month ago
1
Afriaudit - Inaccessible vault share After Changing Savings Address

#106 sherlock-admin2 closed 1 month ago
1
Ragnark_323 - Slippage Handling in permitAndDeposit Function

#105 sherlock-admin4 closed 1 month ago
1
Motomoto - Untracked reward penalty cuts in StakedEXA.sol

#104 sherlock-admin3 closed 1 month ago
1
blockchain555 - stEXA does not strictly comply with eip-20.

#103 sherlock-admin2 closed 1 month ago
0
Ragnark_323 - Floating Pragma in StakedEXA.sol and Importing FixedPointMathLib.sol with Vulnerable Solidity Versions

#102 sherlock-admin4 closed 1 month ago
1
0xBugHunter - In Emergency Situations, Users are Unable to Withdraw Their Assets (stEXA)

#101 sherlock-admin3 closed 1 month ago
0
Motomoto - Users can avoid penalty near refTime

#100 sherlock-admin2 closed 1 month ago
1
Ragnark_323 - No Storage Gap implemented for Upgradeable Contracts in StakedEXA.sol and Market.sol

#99 sherlock-admin4 closed 1 month ago
1
petro1912 - Any call to permit is front runnable, which will cause a DoS

#98 sherlock-admin3 closed 1 month ago
0
John_Femi - More funds will be lost by borrower on partial Liquidation

#97 sherlock-admin2 closed 1 month ago
1
0uts1der - Precision Loss in `notifyRewardAmount` Function Causes Unclaimable RewardToken

#96 sherlock-admin4 opened 1 month ago
2
bareli - use address(this) in place of "this"

#95 sherlock-admin3 closed 1 month ago
1
rilwan99 - Incorrect Discount Application will Reduce Rewards for Long-Term Stakers

#94 sherlock-admin2 closed 1 month ago
1
0x11singh99 - In modifier `permitSender` directly encoding `assets` dynamic array to calculate `hashStruct` is wrong according to `EIP712` specification.

#93 sherlock-admin4 closed 1 month ago
3
0xlexx2310 - Using transfer can cause the lost of funds

#92 sherlock-admin3 closed 1 month ago
1
mgf15 - no validation to ensure the arbitrum sequencer is down

#91 sherlock-admin2 closed 1 month ago
1
unRekt - In `harvest` function `amount` i.e a monetary value is compared with time, can lead to function failing frequently

#90 sherlock-admin4 closed 1 month ago
0
Afriaudit - function `notifyRewardAmount` in stakedEXA.sol incorrectly checks reward token balance in contract when when staked asset is same as reward token.

#89 sherlock-admin3 closed 1 month ago
3
mgf15 - Use of deprecated Chainlink function latestAnswer

#88 sherlock-admin2 closed 1 month ago
1
rilwan99 - Stakers will receive excessive rewards for durations beyond the reference staking period

#87 sherlock-admin4 closed 1 month ago
1
smbv-1923 - Griefing Attack while using `permitAndDeposit()`

#86 sherlock-admin3 closed 1 month ago
1
cholakov - `permitAndDeposit` is allowed to be called by the permit creator only

#85 sherlock-admin2 closed 4 weeks ago
14
smbv-1923 - Loss of user's fund via donation attack in `permitAndDeposit()`

#84 sherlock-admin4 closed 1 month ago
1
rilwan99 - The Market contract will have unlimited access to the StakedEXA contract's provider assets

#83 sherlock-admin3 closed 1 month ago
1
unRekt - `notifyRewardAmount` is logically incorrect which leads to incorrect calculation of `remainingRewards`

#82 sherlock-admin2 closed 1 month ago
1
Nyxaris - Multiple Reward Claims Exploitation in Single Block

#81 sherlock-admin4 closed 1 month ago
4
0xlexx2310 - The function baseRate will result in error if the x > EXP_TRESHOLD

#80 sherlock-admin3 closed 1 month ago
1
KupiaSec - In periods where `totalSupply = 0`, rewards will be locked forever in `StakeEXA` contract

#79 sherlock-admin2 closed 1 month ago
1
KupiaSec - Anyone could call `harvest()` to extend the period finish time

#78 sherlock-admin3 closed 1 month ago
1
sakshamguruji - While Claiming It Should Be Checked If rewardToken Is The Underlying Asset

#77 sherlock-admin3 closed 1 month ago
1
KupiaSec - A malicious attacker can make significant amount of reward token to be locked in `StakedEXA` by calling `harvest()` frequently

#76 sherlock-admin2 closed 1 month ago
0
Shubham - `notifyRewardAmount()` is not called after changing the `rewardData.duration` which leads to incorrect reward distribution

#75 sherlock-admin4 closed 1 month ago
1
0x73696d616f - Some bad debt will not be cleared when it should which will cause accrual of bad debt decreasing the protocol's solvency

#74 sherlock-admin2 opened 1 month ago
0
0x73696d616f - Liquidator will leave a pool with unassigned earnings on `Market::clearBadDebt()` free to claim for anyone when the repaid maturity is not the last

#73 sherlock-admin3 opened 1 month ago
4
cawfree - Stake Donation Evades Excess Staking Penalties

#72 sherlock-admin2 closed 1 month ago
1
eeyore - Incorrect `harvest()` function execution in a situation when `providerRatio == 0`.

#71 sherlock-admin4 closed 1 month ago
0
eeyore - Missing `approve()` in the `setMarket()` function will lead to a Denial of Service (DoS) in the `harvest()` function.

#70 sherlock-admin4 closed 1 month ago
0