Payouts
Top 10
Top 25
Top 50
All
Sherlock
Code4rena
Nov '24
medium
Nibiru's bank coin to EVM balance tracking logic is completely broken for rebasing tokens and would lead to leakage/loss of funds when converting
medium
Nonce can be manipulated by inserting a contract creation EthereumTx message first in an SDK TX with multiple EthereumTX messages
medium
Gas refunds use block gas instead of transaction gas, leading to incorrect refund amounts
Sep '24
high
Wrong division when adjusting `perSecondRate` in compounded factor calculation
high
Tax is resolved on liquidation listings when they are relisted
high
Locker actions affecting utilization rate are not checkpointed
medium
Reserving a listing checkpoints the collection's `compoundFactor` at an intermediary higher compound factor
Jul '24
Jun '24
May '24
Apr '24
high
BalancerConnector has incorrect implementation of totalSupply, positionTVL and total TVL will be invalid
high
`BalancerConnector::_getPositionTVL` is calculated incorrectly
high
`SNXConnector.sol` TVL calculation is incorrect.
high
`executeWithdraw` may be blocked if any of the users are blacklisted from the `baseToken`
high
Decreasing a position in PendleConnector will remove it even if there's still a stake at Penpie
high
Numerous errors when calculating the TVL for the MorphoBlue connector
high
SiloConnector `_getPositionTVL` miscalculate the TVL position
medium
LP tokens from Boosted Positions are not included in the TVL calculation of a position held by the MaverickConnector
medium
In the BalancerConnector, unclaimed rewards are not included in the calculation of the connectors TVL
medium
`Keepers` does not implement EIP712 correctly on multiple occasions
medium
Extra rewards are not updated in curve connector when harvestConvexRewards is called
medium
If a curve pool which CurveConnector uses is killed the vault manager can't close the position leading to loss of funds
medium
In the AerodromeConnector, unclaimed rewards are not included in the calculation of the connectors TVL
medium
Some connectors prevents repayment of a borrow position if it doesn't leave the connector solvent or above minimumHealthFactor
medium
Balancer flashloan contract can be DOSed completely by sending 1 wei to it
medium
`depositQueue.queue` in `AccountingManager` can be flooded causing a DoS
medium
Using the same heartbeat for multiple price feeds