code-423n4/2024-08-phi-validation

Issues

• Unsanitized Input in mint() Allows JSON Injection, Compromising NFT Metadata Integrity

  #634 opened a year ago by c4-bot-3
  2

• Insufficient Slippage Protection in Share Trading

  #651 opened a year ago by c4-bot-7
  2

• QA Report

  #624 opened a year ago by c4-bot-4
  0

• QA Report

  #653 opened a year ago by c4-bot-6
  0

• Gas Optimizations

  #656 opened a year ago by c4-bot-3
  0

• QA Report

  #655 opened a year ago by c4-bot-4
  0

• QA Report

  #663 opened a year ago by c4-bot-9
  0

• Exploitation of Bonding Curve - Underpricing Due to Low Initial Supply.

  #622 opened a year ago by c4-bot-10
  0

• Unchecked ERC20 Return Values in Phi Protocol Contracts Risk Unauthorized State Changes and Financial Discrepancies

  #623 opened a year ago by c4-bot-4
  0

• VerificationType is not enforced for claiming NFT directly with signatureClaim()

  #625 opened a year ago by c4-bot-8
  0

• When calculating the price, the cred can return an incorrect price after a fee.

  #626 opened a year ago by c4-bot-5
  0

• changes balance of all intended actors in RewardControl contract but the actual money not deposited to Rewardcontrol contract

  #627 opened a year ago by c4-bot-8
  0

• Zero Address Issue in `claimFromFactory`

  #628 opened a year ago by c4-bot-1
  0

• Insufficient Ownership Verification in signatureClaim Allows Unauthorized NFT Manipulation

  #629 opened a year ago by c4-bot-8
  0

• Missing validation in `safeBatchTransferFrom` Function

  #630 opened a year ago by c4-bot-4
  0

• excessive gas uses unnecessarily, lead to revert in trasaction due to high gas cost with large numRecipients

  #631 opened a year ago by c4-bot-3
  0

• Potential Issue with Fee-on-Transfer and Blacklisted Tokens in `deposit` Function

  #633 opened a year ago by c4-bot-3
  0

• Unauthorized Withdrawal of User Balances through `WithdrawFor` Function

  #636 opened a year ago by c4-bot-4
  0

• Division by Zero Vulnerability in the `_curve` Function of the `BondingCurve` Contract

  #638 opened a year ago by c4-bot-2
  0

• Buying price is greater than selling price, no one buys a depreciating asset and leads to dead protocol

  #639 opened a year ago by c4-bot-10
  0

• `withdrawFor` can be used to lock some users asset

  #642 opened a year ago by c4-bot-3
  0

• Potential JSON Injection Vulnerability in Metadata Construction

  #644 opened a year ago by c4-bot-1
  0

• Lack of Access Control in RewardControl

  #645 opened a year ago by c4-bot-5
  0

• Incomplete Reward Claims Due to Insufficient Balance and Misleading Event Emissions

  #647 opened a year ago by c4-bot-9
  0

• Strict Check used with `msg.value`

  #648 opened a year ago by c4-bot-9
  0

• Share Lock Period Bypass in Batch Operations

  #650 opened a year ago by c4-bot-7
  0

• Signature Malleability in the `_verifySignature` Function

  #654 opened a year ago by c4-bot-1
  0

• Reentrancy Vulnerability in Reward Distribution and NFT Management Allows Recursive Exploits and Unauthorized Transactions

  #657 opened a year ago by c4-bot-3
  0

• Sandwich Attacks in BondingCurve's Price Calculation Functions

  #658 opened a year ago by c4-bot-3
  0

• `buyShareCredFor` passes the wrong curator to `_handleTrade`

  #659 opened a year ago by c4-bot-3
  0

• Possible underflow could miscalculate fees and revert

  #661 opened a year ago by c4-bot-3
  0

• Insufficient Validation in createArt Allows Manipulation of NFT Creation and Unauthorized Credential Issuance

  #662 opened a year ago by c4-bot-3
  0

• Potential Array Length Mismatch in Batch Operations

  #665 opened a year ago by c4-bot-6
  0

• Unsafe Token Transfer Due to Lack of Address Validation in Smart Contracts

  #666 opened a year ago by c4-bot-2
  0

• `curatorData` indexing within `getCuratorAddresses` is flawed

  #668 opened a year ago by c4-bot-2
  0

• Unrestricted usage of `soulBounded` parameter breaks `PhiNFT1155` compliance with ERC-1155, and allows to create honey pots

  #621 opened a year ago by c4-bot-10
  0

• Using the `this` keyword to pass `mintFee` ETh value in the `claim(...)` function causes loss of excess ETH

  #632 opened a year ago by c4-bot-4
  0

• No limit on `protocolFeePercent` in Cred Contract

  #635 opened a year ago by c4-bot-8
  0

• Attackers will steal tokens via frequent distributions

  #637 opened a year ago by c4-bot-2
  0

• Arts cannot be created if protocol is deployed on zkEVMs or zkSync

  #640 opened a year ago by c4-bot-10
  0

• `updateArtSettings` in `PhiFactory.sol` can still be called even if contract is paused

  #641 opened a year ago by c4-bot-3
  0

• Signature Replay Vulnerability in Art Creation

  #643 opened a year ago by c4-bot-1
  0

• Malicious user could bypass share lock period and receive maximum curator rewards without ever being a share holder

  #646 opened a year ago by c4-bot-9
  0

• PhiNFT1155 are transferrable even after being paused

  #649 opened a year ago by c4-bot-10
  0

• Function _removeCredIdPerAddress() is public leading to DOS attacks when users sell shares

  #652 opened a year ago by c4-bot-5
  0

• Locked Funds Due to Missing Withdraw Function

  #660 opened a year ago by c4-bot-6
  0

• Refunds are not correctly handled and would be locked in PhiNFT1155.sol contract instances and PhiFactory

  #664 opened a year ago by c4-bot-6
  0

• mintProtocolFee and artCreateFee cannot be more than 10000 wei

  #667 opened a year ago by c4-bot-2
  0

• Attacker can DOS user from selling shares of a credId

  #619 opened a year ago by c4-bot-2
  0

• Missing Refund on Excessive Ether Sent in Claim Functions

  #620 opened a year ago by c4-bot-2
  1