hats-finance/Origami-0x998f1b716a5022be026ca6b919c0ddf45ca31abd

Issues

• `RepricingToken::checkpointReserves()` - L168: Should use `<=` here, NOT `<`, otherwise it allows for checkpointing pending reserves BEFORE the `reservesVestingDuration` has completely passed.

  #60 opened 10 months ago by hats-bug-reporter
  3

• `OrigamiOToken::exitToToken()` - L115: Missing return value check for `_transfer()` for oToken, and additionally should use `safeTransfer()` instead.

  #61 opened 10 months ago by hats-bug-reporter
  4

• `LinearWithKinkInterestRateModel::_setRateParams()` - L89: Should use `>` not `>=` for `(_kinkUtilizationRatio >= PRECISION)`.

  #59 opened 10 months ago by hats-bug-reporter
  2

• An attacker can bypass the dynamic fees in `lovStEth` vault under certain depeg conditions, and extract value from honest depositors

  #62 opened 10 months ago by hats-bug-reporter
  3

• the `repay()` function will revert if repay interest rate updates

  #63 opened 10 months ago by hats-bug-reporter
  3

• hardcoding aave pool address is a serious aave integration flaw because valid pool addresses can change

  #58 opened 10 months ago by hats-bug-reporter
  3

• Hardcoded rounding strategy in `DynamicFees::dynamicFeeBps()` rounds against the protocol on lovTokens deposits

  #56 opened 10 months ago by hats-bug-reporter
  2

• There may be a lesser amount of Aave aTokens than what is tracked in the OrigamiAaveV3BorrowAndLend.

  #52 opened 10 months ago by hats-bug-reporter
  2

• `OrigamiAbstractLovTokenManager::maxInvest()` does not take into account the `redeemableReservesBuffer()`

  #50 opened 10 months ago by hats-bug-reporter
  4

• In some cases, the redemption process in the Repricing Token may be reverted.

  #55 opened 10 months ago by hats-bug-reporter
  3

• Changing `globalInterestRateModel` need to be automatically reflected or trigger borrowers refresh

  #57 opened 10 months ago by hats-bug-reporter
  2

• It is not possible to rebalance-down the `lovDsr` strategy when the USDC borrows circuit-breaker cap is hit, even when using `forceRebalanceDown()`

  #54 opened 10 months ago by hats-bug-reporter
  2

• Incorrect thresholds configuration in `OrigamiIdleStrategyManager` will make the two thresholds compete against each other

  #53 opened 10 months ago by hats-bug-reporter
  1

• The donated debt token can be used for repayment when attempting to rebalance up in the OrigamiLovTokenFlashAndBorrowManager.

  #51 opened 10 months ago by hats-bug-reporter
  2

• attacker can take most of the usdc from the protocol by flashloan

  #37 opened 10 months ago by hats-bug-reporter
  12

• Adversary can block any `exit` due to `preCheck` reached `cap` by using flash-loan

  #27 opened 10 months ago by hats-bug-reporter
  6

• In OrigamiAaveV3BorrowAndLend, the ability to recover borrowToken should be restricted

  #47 opened 10 months ago by hats-bug-reporter
  6

• The rounding direction is inverted in the _maxUserReserves function

  #48 opened 10 months ago by hats-bug-reporter
  4

• `OrigamiWstEthToEthOracle` utilizes Chainlink's stETH/ETH feed which has 24 hour long Heartbeat

  #17 opened 10 months ago by hats-bug-reporter
  6

• latestPrice() doesn't check Arbitrum l2 chainlink feed is active

  #49 opened 10 months ago by hats-bug-reporter
  8

• Some USDC tokens are missing when calculating the global available borrow amount and global utilization ratio.

  #46 opened 10 months ago by hats-bug-reporter
  1

• When we update the old IdleStrategy, there may be some USDC tokens in that.

  #45 opened 10 months ago by hats-bug-reporter
  1

• Anyone can manipulate the AL ratio.

  #41 opened 10 months ago by hats-bug-reporter
  6

• OrigamiDexAggregatorSwapper.sol : unsafe unchecked block would lead to loss of funds

  #35 opened 10 months ago by hats-bug-reporter
  7

• We can burn more debt than the exact amount when withdrawing in OrigamiLendingClerk.

  #15 opened 10 months ago by hats-bug-reporter
  2

• `OrigamiOTokenManager` should be initialized in constructor

  #25 opened 10 months ago by hats-bug-reporter
  1

• `OrigamiLovTokenFlashAndBorrowManager::forceRebalanceUp()` will revert when attempting to pay a `flashLoanAmount` higher than the current debt

  #33 opened 10 months ago by hats-bug-reporter
  1

• `OrigamiLendingClerk::borrowMax()` will revert everytime `_availableToBorrow()` returns a higer value than the remaining amount until hitting the circuit-breaker cap

  #44 opened 10 months ago by hats-bug-reporter
  2

• `OrigamiLendingSupplyManager::maxExit()` does not account for circuit breaker cap when returning the max exit amount

  #39 opened 10 months ago by hats-bug-reporter
  1

• Rounding in LovTokenManager doesn't sync with design

  #32 opened 10 months ago by hats-bug-reporter
  1

• The slippage protection in `OrigamiAbstractLovTokenManager::investQuote` rounds against protecting the user because of 'ROUND_DOWN' mode being hardcoded

  #16 opened 10 months ago by hats-bug-reporter
  1

• Performance Fee calculation potential revenue loss on changing `performanceFee` value

  #40 opened 10 months ago by hats-bug-reporter
  2

• Insufficient input validation in `LinearWithKinkInterestRateModel::_setRateParams()` allows for steeper slope before the kink

  #42 opened 10 months ago by hats-bug-reporter
  1

• attacker can take over USDC by calling investWithToken/exitToken more than once

  #38 opened 10 months ago by hats-bug-reporter
  3

• Dandling approvals in `FlashLoanProvider` contract with Aave pools as spenders

  #43 opened 10 months ago by hats-bug-reporter
  2

• Incorrect value of `totalDebtRepaid` in the event `RebalanceUp()` when attempting to repay more debt than the remaining one (when `amountRepaid < flashLoanAmount`)

  #31 opened 10 months ago by hats-bug-reporter
  2

• First depositor can significantly inflate share value and limit vault operability

  #36 opened 10 months ago by hats-bug-reporter
  3

• Excess amount of debtToken asset is not accounted when rebalanceUp, making the asset untracked

  #28 opened 10 months ago by hats-bug-reporter
  1

• `exitToToken()`does not check `maxExit` limit

  #24 opened 10 months ago by hats-bug-reporter
  1

• `investWithToken()`does not check `maxInvest` limit

  #23 opened 10 months ago by hats-bug-reporter
  1

• Investment and exit paused must be checked in `investWithToken()` and `exitToToken()`

  #22 opened 10 months ago by hats-bug-reporter
  1

• `price()`will return the wrong price for asset if the underlying aggregator hits minAnswer

  #21 opened 10 months ago by hats-bug-reporter
  1

• Unhandled chainlink revert would lock price oracle access in `price()`

  #20 opened 10 months ago by hats-bug-reporter
  1

• Rebalance can be temporarily prevented by sending dust amount

  #19 opened 10 months ago by hats-bug-reporter
  1

• `OrigamiLovToken::collectPerformanceFees()` can be frontrunned to extract value

  #18 opened 10 months ago by hats-bug-reporter
  2

• In some cases, users may be unable to invest in the OvUSDC vault.

  #14 opened 10 months ago by hats-bug-reporter
  1

• the otoken contract did not respect users minimum slippage which may cause loss of tokens value

  #29 opened 10 months ago by hats-bug-reporter
  2

• there is no check for deadline in `investwithToken` function inside origamiOtoken.sol which opens the possibility to theft of funds

  #30 opened 10 months ago by hats-bug-reporter
  2

• OrigamiDexAggregatorSwapper : absense of slippage protection lead to loss of funds.

  #34 opened 10 months ago by hats-bug-reporter
  1

• Use of slot0 to get sqrtPriceLimitX96 can lead to price manipulation. #823

  #26 opened 10 months ago by hats-bug-reporter
  1