17 findings across 11 protocols

The external call target inside createTokenApprovalVote() (_token.minter() -> pool.withdraw_admin_fees()) is a raw, caller-supplied parameter rather than a fixed address - fully attacker-controlled, unlike a sibling finding on the same run that turned out to be a false positive precisely because its call target was immutable and hookless.

Verified with working PoC

LemonCurveFactory.launch() accepts caller-supplied dexFactory/positionManager addresses with no validation against canonical DEX addresses. At graduation, the bonding curve approves the attacker-chosen positionManager for all real buyer ETH and calls mint() on it.

Verified with working PoC

When a Lender (Yearn V3 vault) withdrawal exceeds idle liquidity, TroveManager.redeem() kicks a Dutch auction with receiver set to the withdrawing depositor themselves. TokenizedStrategy permanently marks the shortfall as a realized loss for all remaining depositors.

Verified with working PoC

The same auction self-deal root cause is separately reachable from TroveManager.open_trove()/borrow(): _transfer_borrow_tokens() calls the internal _redeem() with its default receiver = msg.sender whenever requested debt exceeds idle liquidity.

Verified — second entry point, same root cause

_initialize() is meant to run exactly once, guarded by require(_initializer != address(0)). _initializer starts as the deployer's address and is set to address(1) after the first call - both states are nonzero, so the guard never actually blocks re-invocation.

Verified with working PoC

RedeemHandler.redeem() burns order.usnAmount and pays out order.collateralAmount with no on-chain relationship enforced between the two, for any caller holding BURNER_ROLE.

Verified with working PoC

mint()'s zero-amount guard and 2%-band collateral/usnAmount ratio check are both gated behind order.user != msg.sender, so any address holding MINTER_ROLE that is also a whitelisted user can self-mint an arbitrary usnAmount with collateralAmount = 0.

Verified with working PoC

An honest, fully valid IntentGatewayV2.placeOrder() order that unwraps a real LP position via predispatch strands the undeclared leg on CallDispatcher, which an unrelated third party can then drain via a direct, unauthenticated dispatch() call.

Verified with working PoC

Lender.adjust() credits a user's internal collateral ledger with the requested transfer amount, not the amount actually received. Any fee-on-transfer or deflationary collateral token lets a user borrow against an inflated ledger balance.

Confirmed and verified — not currently exploitable on live markets

ChainlinkPrices has no check for Base sequencer liveness anywhere in its price validation path - a known, precedented vulnerability class (multiple Arbitrum protocols were exploited by exactly this gap in 2023).

Verified against real source, 3 findings total

DLMMPool's active-bin share-minting formula omits a fee term the upstream Trader Joe V2 codebase it forked from includes, understating the liquidity denominator and over-minting LP shares on imbalanced active-bin deposits that trigger a composition fee.

Confirmed real deviation from upstream — no profitable exploit path found

VoterV5._vote()/_reset() never refresh a gauge's reward-index checkpoint - unlike real Velodrome, which updates it on every vote action. The checkpoint only advances via distribute()/killGauge(), which is permissionless and unenforced per-epoch, so a gauge that goes unvoted for N epochs then receives even minimal weight captures the full N-epoch accumulated index delta.

Verified with working PoC

VotingEscrowV2_LockLogic._claim() calls token.burn(penaltyAmount) whenever an early exit's penalty is nonzero, but the real deployed ORVX token (ERC20 + ERC20Permit + Ownable2Step only) has no burn() function at all. Any user - no privileged role needed - who locks ORVX in a NON_PERMANENT lock and later tries to exit early, accepting the documented penalty, has the transaction unconditionally revert.

Verified with working PoC

oORVX's exerciseVe() converts option tokens into a permanent veORVX lock via createLockFor(), which unconditionally calls token.burnFrom() for any PERMANENT lock inside VotingEscrowV2_LockLogic._updateLock(). ORVX has no burnFrom() either, so this documented conversion path is completely non-functional for every holder.

Verified — second entry point, same root cause

bveORVX's optionToken is statically typed as the 5-argument OptionTokenV3.exerciseVe(uint256,uint256,address,uint256,uint256) (selector 0xa9f6ee33), but the contract actually deployed at that address only implements the simpler 2-argument exerciseVe(uint256,address) (selector 0x9130325d) - two entirely different functions as far as the EVM is concerned.

Verified with working PoC

The guard require(_initializer != address(0), 'already initialized') is satisfied by any nonzero value, including the sentinel it sets on completion - so it never blocks a second call. The governor can re-run the genesis-distribution function at will, silently rewinding whatever decay curve the emission schedule applies.

Verified with working PoC

RiskEngine._getMargin() calls CollateralTracker.assetsAndInterest(), which pairs a stale, stored collateral valuation (totalAssets() includes s_marketState.unrealizedInterest(), only refreshed by the next accrual-triggering call) against a freshly-simulated debt figure. dispatchFrom() never forces accrual before this eligibility check, so a position that is genuinely solvent under same-basis fresh accounting can be judged insolvent and liquidated.

Confirmed with working PoC - not currently exploitable (no live victim under current usage)