- [M-01] Missing deadline checks allow pending transactions to be maliciously executed - www.papr.wtf - 2023-Jan - NFT lending
- [M-02] Disabled NFT collateral should not be used to mint debt - www.papr.wtf - 2023-Jan - NFT lending
- [M-03] Grieving attack by failing user’s transactions - www.papr.wtf - 2023-Jan - NFT lending
- [M-04] Incorrect usage of safeTransferFrom traps fees in Papr Controller - www.papr.wtf - 2023-Jan - NFT lending
- [M-05] PaprController.buyAndReduceDebt: msg.sender can lose paper by paying the debt twice - www.papr.wtf - 2023-Jan - NFT lending
- [M-06]
PaprController
pays swap fee inbuyAndReduceDebt
, not user - www.papr.wtf - 2023-Jan - NFT lending - [M-07] Last collateral check is not safe - www.papr.wtf - 2023-Jan - NFT lending
- [M-08] User fund loss because function
purchaseLiquidationAuctionNFT()
takes extra liquidation penalty when user’s last collateral is liquidated, (set wrong value formaxDebtCached
whenisLastCollateral
is true) - www.papr.wtf - 2023-Jan - NFT lending - [M-01] Missing deadline checks allow pending transactions to be maliciously executed - caviar.sh✅
- [M-02] Price will not always be 18 decimals, as expected and outlined in the comments - caviar.sh✅
- [M-03] Rounding error in
buyQuote
might result in free tokens - caviar.sh - [M-04] It's possible to swap NFT token ids without fee and also attacker can wrap unwrap all the NFT token balance of the Pair contract and steal their air drops for those token ids - caviar.sh
- [M-05] Pair price may be manipulated by direct transfers - caviar.sh
- [M-01] Bypass
userWithdrawLimitPerPeriod
check - prepo.io✅ - [M-02] The recipient receives free collateral token if an ERC20 token that deducts a fee on transfer used as baseToken - prepo.io
- [M-03] Frontrunning for unallowed minting of Short and Long tokens - prepo.io
- [M-04] PrePO NFT holders will not be able to redeem collateral - prepo.io
- [M-05]
PrePOMarket.setFinalLongPayout()
shouldn’t be called twice. - prepo.io - [M-06] Manager can get around min reserves check, draining all funds from Collateral.sol - prepo.io
- [M-07] Users do not receive owed tokens if
TokenSender
contract cannot cover their owed amount. - prepo.io - [M-01] An attacker can make users unable to cancel their L1 calls on Ethereum To Arbitrum - pooltogether.com/de
- [M-02] When a smart contract calls
CrossChainRelayerArbitrum.processCalls
, excess submission fees may be lost - pooltogether.com/de - [M-03]
CrossChainExecutor
contracts do not update the necessary states for failing transactions - pooltogether.com/de