as16x / Medium-Risk-Findings-C4A

2023-Medium-Risk-Findings-C4A

2023-Medium-Risk-Findings-C4A

• [M-01] Missing deadline checks allow pending transactions to be maliciously executed - www.papr.wtf - 2023-Jan - NFT lending
• [M-02] Disabled NFT collateral should not be used to mint debt - www.papr.wtf - 2023-Jan - NFT lending
• [M-03] Grieving attack by failing user’s transactions - www.papr.wtf - 2023-Jan - NFT lending
• [M-04] Incorrect usage of safeTransferFrom traps fees in Papr Controller - www.papr.wtf - 2023-Jan - NFT lending
• [M-05] PaprController.buyAndReduceDebt: msg.sender can lose paper by paying the debt twice - www.papr.wtf - 2023-Jan - NFT lending
• [M-06] PaprController pays swap fee in buyAndReduceDebt, not user - www.papr.wtf - 2023-Jan - NFT lending
• [M-07] Last collateral check is not safe - www.papr.wtf - 2023-Jan - NFT lending
• [M-08] User fund loss because function purchaseLiquidationAuctionNFT() takes extra liquidation penalty when user’s last collateral is liquidated, (set wrong value for maxDebtCached when isLastCollateral is true) - www.papr.wtf - 2023-Jan - NFT lending
• [M-01] Missing deadline checks allow pending transactions to be maliciously executed - caviar.sh✅
• [M-02] Price will not always be 18 decimals, as expected and outlined in the comments - caviar.sh✅
• [M-03] Rounding error in buyQuote might result in free tokens - caviar.sh
• [M-04] It's possible to swap NFT token ids without fee and also attacker can wrap unwrap all the NFT token balance of the Pair contract and steal their air drops for those token ids - caviar.sh
• [M-05] Pair price may be manipulated by direct transfers - caviar.sh
• [M-01] Bypass userWithdrawLimitPerPeriod check - prepo.io✅
• [M-02] The recipient receives free collateral token if an ERC20 token that deducts a fee on transfer used as baseToken - prepo.io
• [M-03] Frontrunning for unallowed minting of Short and Long tokens - prepo.io
• [M-04] PrePO NFT holders will not be able to redeem collateral - prepo.io
• [M-05] PrePOMarket.setFinalLongPayout() shouldn’t be called twice. - prepo.io
• [M-06] Manager can get around min reserves check, draining all funds from Collateral.sol - prepo.io
• [M-07] Users do not receive owed tokens if TokenSender contract cannot cover their owed amount. - prepo.io
• [M-01] An attacker can make users unable to cancel their L1 calls on Ethereum To Arbitrum - pooltogether.com/de
• [M-02] When a smart contract calls CrossChainRelayerArbitrum.processCalls, excess submission fees may be lost - pooltogether.com/de
• [M-03] CrossChainExecutor contracts do not update the necessary states for failing transactions - pooltogether.com/de