code-423n4/2024-07-loopfi-validation

Issues

• maxFlashLoan check is missing in function flashLoan and function creditFlashLoan

  #781 opened a year ago
  0

• bug in `claim` allows users who are disqualified to claim their previously earned emissions

  #780 opened a year ago
  0

• Wrong debt accouting in liquidatePosition()

  #779 opened a year ago
  0

• Inefficient Removal of Vaults in VaultRegistry.sol

  #778 opened a year ago
  0

• Improper Deletion in Array IN VaultRegistry.sol

  #777 opened a year ago
  0

• QA Report

  #776 opened a year ago
  1

• QA Report

  #775 opened a year ago
  0

• No Access Control on Contract Initialization in Silo.sol

  #774 opened a year ago
  0

• QA Report

  #773 opened a year ago
  0

• `BalancerOracle::update()` can return stale price

  #772 opened a year ago
  0

• Unrestricted Withdraw Function in Silo.sol

  #771 opened a year ago
  0

• Attacker can prevent users from depositing.

  #770 opened a year ago
  0

• Incorrect Access Control in updateQuotaRevenue

  #769 opened a year ago
  0

• QA Report

  #768 opened a year ago
  1

• `CDPVault::liquidatePosition` may revert even when paying full repayAmount, if the newDebt amount calculated is less than `vaultConfig.debtFloor` amount

  #767 opened a year ago
  0

• Liquidations will not be possible once oracle price is 0

  #766 opened a year ago
  0

• `vestTokens` bug in MultiFeeDistribution.sol causes new incentives to erase previous incentives

  #765 opened a year ago
  0

• Hardcoded Timestamp Values can introduce rounding errors

  #764 opened a year ago
  0

• Lack of Slippage Protection in liquidatePosition function

  #763 opened a year ago
  0

• Rate Integrity Compromise During and After Frozen Periods in `GaugeV3.sol`

  #762 opened a year ago
  0

• Preview Functions Don't Revert Appropriately According to ERC4626 standards

  #761 opened a year ago
  0

• Potential for ETH to be Locked in Contract When Joining Balancer Pools

  #760 opened a year ago
  0

• Unlimited Token Generation Exploit in PoolV3.sol

  #759 opened a year ago
  0

• Mismanagement of ETH in the join() Function Poses Significant Risk of Funds Loss

  #758 opened a year ago
  0

• Inaccurate Interest Accrual Due to block.number Usage

  #757 opened a year ago
  0

• No Circuit-Breaker checks in `ChainlinkOracle.sol`

  #756 opened a year ago
  0

• Lack of slippage control in withdraw and redeem Functions

  #755 opened a year ago
  0

• Wrong calculation of newCumulativeIndex in case of partial borrowing interest repayment

  #754 opened a year ago
  0

• Lack of Vote Decay in GaugeV3 Contract

  #753 opened a year ago
  1

• Chainlink can return stale price in `AuraVault::_chainlinkSpot()` and `AuraVault::_getAuraSpot()`

  #752 opened a year ago
  1

• Lack of Grace Period After Oracle Recovery in Liquidation Functions

  #751 opened a year ago
  0

• `lastRPS` can be set to 0, causing `rewardsPerSecond` to lose its original value

  #750 opened a year ago
  0

• Lack of slippage control in `_deposit` Function

  #749 opened a year ago
  0

• Potential Sandwich Attack Vulnerability in Oracle Updates

  #748 opened a year ago
  0

• Total debt could exceed the debt ceiling due to interest accrual

  #747 opened a year ago
  0

• PoolV3.sol is not fully up to EIP-4626's specification

  #746 opened a year ago
  0

• Bringing a position from unsafe to safe by liquidation paritally

  #745 opened a year ago
  1

• Incorrect Updating of `maxAmountsIn` for Tokens After Pool Token

  #744 opened a year ago
  0

• Inconsistent Bad Debt Checks Allow Overlap in Liquidation Function Usage

  #743 opened a year ago
  0

• Inconsistent checking for bad debt

  #742 opened a year ago
  0

• Insufficient Handling of Pool Token BPT in maxAmountsIn Array

  #741 opened a year ago
  0

• Potential loss of funds due to inflexible liquidation process in CDPVault

  #740 opened a year ago
  1

• Index Misalignment in updateLeverJoin Function

  #739 opened a year ago
  0

• No array length check in multisend

  #738 opened a year ago
  0

• Front-running attack could possibly block legitimate full liquidations

  #737 opened a year ago
  0

• Unauthorized Token Transfer in transferAndJoin

  #736 opened a year ago
  0

• Malicious Borrower Cycle Exploits to Inflate Interest Rates

  #735 opened a year ago
  0

• Incorrect Implementation of ERC-3156 maxFlashLoan Function

  #734 opened a year ago
  0

• Inadequate Access Control in `setAllowed` Function

  #733 opened a year ago
  0

• Partial liquidations and price changes can block liquidations

  #732 opened a year ago
  0