Immunefi Audit CompetitionsAlchemix V3
Reports by Severity
Critical
- 57138 - [SC - Critical] protocol subsidizes repayment fees during liquidation
- 57662 - [SC - Critical] portion of users alasset amount that staked in transmuter can be lost forever when amount cumulativeearmarked
- 56435 - [SC - Critical] alchemistv3 repayment only liquidation pays liquidator from pool fee leak theft of unclaimed yield
- 58036 - [SC - Critical] incorrect fee deduction may drain collateral pool when account balance is insufficient
- 57360 - [SC - Critical] unreconciled repayment fee transfer enables myt overpayment and tvl inflation
- 58163 - [SC - Critical] total loss of user funds in claim redemption
- 58724 - [SC - Critical] partial redemption burns full position accounting desynchronization and potential underpayment in transmuter claimredemption
- 58338 - [SC - Critical] alchemistv3 repayment fee can exceed remaining collateral leading to position insolvency
- 58683 - [SC - Critical] there is an issue in earmarked debt eeduction in the repay can causes a permanent fund freeze
- 56519 - [SC - Critical] unchecked repayment fee transfer in liquidate pays liquidators from other users collateral
- 57590 - [SC - Critical] double counted transmuter cover in redeem allows overstated redemptions and potential over withdraw over borrow
- 58270 - [SC - Critical] incorrect handling of debt cover in redeem can affect early liquidation and incorrectly sync accounts
- 58413 - [SC - Critical] attacker user can prevent earmark from updating the earnmarkweight causing the transmuter action to repay det gradually to fail for all users
- 56555 - [SC - Critical] user can avoid bad debt ratio scaling when claiming redeem leading to protocol insolvency
- 58757 - [SC - Critical] forgotten cover in earmark causes systematic over earmarking and temporary freezing of user collateral
- 57973 - [SC - Critical] repay doesnt set lasttransmutertokenbalance leading to the same balance covering earmark twice
- 57093 - [SC - Critical] potential locked funds due to partial redeem shortfall and miss calculation lead to user loss their myt token forever
- 57582 - [SC - Critical] calling earmark one block apart skips the block s earmark value
- 56732 - [SC - Critical] incorrect boundary condition in querygraph leads to systematic under earmarking and transmuter redemption fund loss
- 57122 - [SC - Critical] mismatch between capped fee and returned fee in resolverepaymentfee
- 56965 - [SC - Critical] alchemistv3 handling of added transmuter coverage includes an error that enables an attacker to cause protocol insolvency
- 58131 - [SC - Critical] rounding errors in debt to collateral conversions allow attackers to drain protocol assets
- 56491 - [SC - Critical] user collateral loss triggered by setminimumcollateralization update
- 58626 - [SC - Critical] repayment fee overpayment in liquidation repay only path
- 56365 - [SC - Critical] liquidation fee overdraft drains pooled collateral
- 58507 - [SC - Critical] repayment fee after forcerepay could result in socialized loss during global undercollateralization
- 58320 - [SC - Critical] incorrect fee return value in resolverepaymentfee enables fund theft under extreme conditions
- 58323 - [SC - Critical] the alchemist burn function experiences precision loss resulting in the avoidance of protocol fees
- 57066 - [SC - Critical] a malicious actor can keep calling poke at every block to prevent collateral earmarking exposing transmuter users to delayed redemptions and loss of funds
- 57330 - [SC - Critical] resolverepaymentfee returns initial fee when fee is greater collateral balance
- 58531 - [SC - Critical] querygraph function zero return bug causing tracking earmarking failure over progressive block intervals
- 57916 - [SC - Critical] repay removes earmark meant to be reducing debt while collateral is still reduced
- 58125 - [SC - Critical] repayment fee overpayment from pooled collateral
- 57101 - [SC - Critical] same block earmark early exit leaves stale transmuter balance causing under earmarking
- 58688 - [SC - Critical] alchemistv3 liquidate can steal other users collateral
- 56798 - [SC - Critical] flash vote exploit drains all funds via alchemistallocator
- 56740 - [SC - Critical] unbounded liquidation fee allows theft of shared collateral
- 58138 - [SC - Critical] liquidator fees could surpass the user remaining collateral resulting in protocol insolvency
- 58544 - [SC - Critical] it is possible to underflow on sync making positions bricked forever
- 58443 - [SC - Critical] incorrect consumption of yield cover in redeem leading to reuse of accrued yield
- 58447 - [SC - Critical] unfair collateral loss through socialized redemption costs
- 58564 - [SC - Critical] earmarked funds fail to accumulate when earmark is called in consecutive blocks
- 58518 - [SC - Critical] liquidation will steal repayment fee from innocent users funds
- 58101 - [SC - Critical] repayment only liquidation overpays fee from pooled collateral
- 56622 - [SC - Critical] repayment fee overpays liquidators using pooled collateral after forcerepay
- 58793 - [SC - Critical] repayment fee overpayment from global collateral pool
- 58464 - [SC - Critical] repayment fee paid from protocol funds when user collateral is depleted
- 58573 - [SC - Critical] alchemistv3 repayment fee cross account theft vulnerability
- 56385 - [SC - Critical] repayment fee can be paid from the pool even when the account has no collateral left
- 58288 - [SC - Critical] incorrect fee payment logic leads to underpayment
- 57774 - [SC - Critical] Redemption Earmark Mechanism Can Be Permanently Blocked via Single-Block Earmark Calls
- 56794 - [SC - Critical] liquidators can be overpaid due to accounting error
- 57053 - [SC - Critical] integer division precision loss in normalizedebttokenstounderlying leads to permanent collateral locking
- 57587 - [SC - Critical] earmark reduction of transmuterdifference does not always account for the full transmuter balance diff which can cause permanent earmark to accrue in alchemist
- 58306 - [SC - Critical] repayment fee not adjusted for insufficient collateral
- 58276 - [SC - Critical] uncapped feeinyield in resolverepaymentfee allows for collateral theft from other depositors
- 58689 - [SC - Critical] incorrect deduction logic in alchemistv3 redeem may lead to insufficient contract collateral
- 58280 - [SC - Critical] repayment s fee is charged from other users causing the contract to fail when the myt total balance of a user cannot cover the fee
- 58399 - [SC - Critical] precision loss in baddebtratio calculation causes overpayment and dos
- 57852 - [SC - Critical] old borrowers steal from new borrowers after redemptions are claimed
- 58772 - [SC - Critical] resolverepaymentfee overpays liquidators when collateral is gone letting attackers drain myt
- 57441 - [SC - Critical] repay only fee drain in alchemistv3
- 58301 - [SC - Critical] accounting issue in liquidation logic after force repay we charge repayment fee even if collateral balanc cannot account for it
- 57617 - [SC - Critical] Protocol-paid repayment fee transfer allows draining of protocol MYT (yield)
- 58127 - [SC - Critical] users can invoke the poke function whenever the lastearmarkdebtblock is exactly one block behind the current block number which lead to affecting users earmarked debt
- 58234 - [SC - Critical] there is a problem related ot repayment fee overpayment can lead to protocol insolvency
- 56702 - [SC - Critical] claimredemption would not return all alasset that is not get converted to myt in some case
High
- 58742 - [SC - High] liquidators will not earn fees in some cases
- 57378 - [SC - High] impossible to withdraw yield from strategies
- 58395 - [SC - High] repayment fee exit leaves mytsharesdeposited inflated hiding protocol insolvency
- 58763 - [SC - High] accounting is broken when redeem is bypassed due to transmuter balance
- 58768 - [SC - High] mytsharesdeposited is not updated during liquidations breaking core accounting
- 58759 - [SC - High] yield stuck in adapter contracts forever
- 56359 - [SC - High] permanent deposit freeze after forcerepay misaccounts freed shares
- 56552 - [SC - High] liquidation fee misrouting in alchemistv3 doliquidation leads to theft of unclaimed yield liquidator fee stranded
- 56560 - [SC - High] liquidation base fee transfer is gated by a condition that s usually false
- 58150 - [SC - High] missing slippage protection in tokeautousdstrategy allocate leads to direct theft of user funds via mev sandwich attacks
- 57102 - [SC - High] TVL Overstatement from _mytSharesDeposited Desync Enables Softened Liquidations & No‑Haircut Over‑Redemptions (Transmuter)
- 57129 - [SC - High] missing mytsharesdeposited decrement in liquidation functions causes permanent tvl inflation
- 56956 - [SC - High] lack of slippage control in tokemak strategies can make myt suffer losses on allocation
- 57530 - [SC - High] stale tvl accounting in liquidations leads to protocol insolvency
- 56516 - [SC - High] allocate assets in killswitch mode can lead to assets stuck on contract
- 57604 - [SC - High] nominal accounting mismatch in moonwell strategies leads to permanent locking of all generated yield
- 57860 - [SC - High] incorrect mytsharesdeposited accounting inflates collateral and underreports bad debt enabling insolvency
- 58534 - [SC - High] zero slippage protection in toke strategies allocation
- 58615 - [SC - High] mytsharesdeposited didn t get updated after forcerepay doliquidation called
- 58098 - [SC - High] there is a problem from ledger tvl sesync inliquidations cause a under liquidation and systemic insolvency risk
- 58780 - [SC - High] weth yield will be locked on aaveweth pool on arbitrum
- 58526 - [SC - High] missing accounting update in liquidation functions leads to permanent dos on deposits
- 58471 - [SC - High] accounting error in forcerepay doliquidation overstates tvl enabling under scaled redemptions and potential insolvency
- 58116 - [SC - High] tvl accounting mismatch leading to protocol insolvency
- 57506 - [SC - High] force repay don t update cumulativeearmarked variable
- 57977 - [SC - High] inconsistent rawlocked state of a user after subdebt leads to irrecoverable user collateral loss
- 58635 - [SC - High] cumulativeearmarked is not subtracted in forcerepay
- 57345 - [SC - High] missing cumulativeearmarked decrement in forcerepay breaks earmarking invariant leading to unfair redemption burden distribution
- 58004 - [SC - High] protocol insolvency from cumulativeearmarked during forcerepay
- 58236 - [SC - High] accounting mismatch forcerepay doliquidation fail to decrement mytsharesdeposited locking deposit capacity and overstating collateral
- 57088 - [SC - High] unscaled collateral accounting in redeem lets users withdraw more than intended
- 58324 - [SC - High] incorrect return value in deallocate function leads to permanent fund locking in mytstrategy implementations
- 58394 - [SC - High] mev opportunity because no slippage protection in tokeautoethstrategy
- 57787 - [SC - High] asset can be transferred to strategies even when the killswitch enabled without posibility to use this funds for allocation
- 58519 - [SC - High] double counting of collateral due to mytsharesdeposited not being updated during liquidations
- 58702 - [SC - High] no slippage provided in auto strategy implementation will open room for mev attacks
- 58347 - [SC - High] accounting drift due to missing mytsharesdeposited decrements during liquidation
- 58769 - [SC - High] forcerepay fails to decrement global cumulativeearmarked causing redemption accounting desynchronization and potential protocol wide redemption halt
- 57680 - [SC - High] peapodsethstrategy unable to withdraw yield from price share increase
- 56776 - [SC - High] tvl manipulation via missing mytsharesdeposited decrement in liquidations
- 57023 - [SC - High] global earmark not reduced in forcerepay lets redeem over burn global debt cross account leakage protocol insolvency
- 57950 - [SC - High] unit mismatch in adddebt collateralization check allows unbacked debt issuance and protocol insolvency
- 58398 - [SC - High] no slippage protection on large allocation deposits
- 57288 - [SC - High] flawed rounding logic in tokeautoeth deallocate function causes permanent freezing of funds
- 57704 - [SC - High] missing global state update in forcerepay leads to permanent freezing of unclaimed yield
- 58442 - [SC - High] liquidation breaks core accounting invariant missing cumulativeearmarked update in forcerepay causes permanent state drift
- 56571 - [SC - High] inflated claim payouts from double counted myt after liquidation
- 58781 - [SC - High] totallocked accounting mismatch leading to token balance deficit in alchemistv3
- 58547 - [SC - High] mismatched accounting and transfer for capped fees
- 57632 - [SC - High] inflated tvl in mytsharesdeposited hides protocol insolvency
- 57730 - [SC - High] liquidation does not decrease mytsharesdeposited
- 56678 - [SC - High] missing internal myt shares accounting in liquidation functions causes deposit blocking and protocol insolvency risk through inflated tvl calculations
- 56719 - [SC - High] the function forcerepay reduces debt before clamp creating unbacked loan forgiveness and protocol insolvency
- 56791 - [SC - High] missing mytsharesdeposited decrements in token transfers
- 57849 - [SC - High] funds gets stuck even when killswitch is enabled
- 58207 - [SC - High] AlchemistV3 _mytSharesDeposited Not Reduced When Repaid Collateral Sent to Transmuter
- 58452 - [SC - High] mytstrategy allocation underflow in deallocate when allocation profits exceed old allocation
- 56809 - [SC - High] vulnerable redemption survival ratio in sync allows theft of altokens
- 57692 - [SC - High] alchemistv3 liquidation fee loss vulnerability
- 58474 - [SC - High] liquidator will bypass liquidation fees affecting protocol revenue
- 58274 - [SC - High] liquidation fee logic in doliquidation strands liquidator rewards when balance is exhausted freezing funds
- 58522 - [SC - High] earmark consumes excess cover inflating cumulativeearmarked
- 58358 - [SC - High] mismatched collateralweight and rawlocked causes incorrect collateral removal in sync
- 58792 - [SC - High] the cumulativeearmark does not decrease in forcerepay which lead to transfer more collateral from users even when all earmark debt cleared which breaks the alchemix v3 core logic
- 57212 - [SC - High] totallocked is not properly decremented in the redeem function causing system insolvency
- 57793 - [SC - High] cumulativeearmarked variable is not updated in forcerepay function breaking core internal logic and leading to user funds being stuck
- 58450 - [SC - High] missing transmuter balance update after redemption blocks future earmarking and underfunds redemptions
- 56757 - [SC - High] incorrect leftover collateral check blocks liquidator fee payment leading broken incentives delayed deleveraging
- 58628 - [SC - High] attackers can avoid redemption losses by temporarily burning and re borrowing the debt
- 58129 - [SC - High] missing mytsharesdeposited update in forcerepay causes accounting inconsistency which can dos deposit and liquidation
- 57633 - [SC - High] block gated earmark call in redeem nullifies prefunded transmuter cover on the first redemption of each block leading to collateral overpayment and potential protocol insolvency
- 57585 - [SC - High] alchemistv3 does not properly update cdp collateralbalance when redemptions exceed totallocked which enables some cdps to over withdraw collateral on account of others
- 57460 - [SC - High] protocol fails to subtract fee from total locked when burning and repaying
- 58086 - [SC - High] mis accounting of myt outflows inflates tvl distorts collateralization and can dos deposits liquidations
- 57189 - [SC - High] alchemistcurator contract not implement setforcedeallocatepenalty
- 56395 - [SC - High] accounting desync in liquidation outflows leads to artificial deposit cap exhaustion and denial of service on recapitalization
- 58491 - [SC - High] mytsharesdeposited not reduced on liquidation leading to deposit cap bypass and potential insovency
- 57751 - [SC - High] there is a problem related to forced liquidation branch and this creates issue thatk cna drains protocol backing
- 57941 - [SC - High] incorrect handling of deallocate return val causes any interest gains in a strategy to become unclaimable and permanently locked
- 58572 - [SC - High] liquidation of account collateral doesn t subtract mytsharesdeposited which creates bad debt in the system and causes insolvency
- 58019 - [SC - High] flawed killswitch implementation in mytstrategy leads to permanent loss of funds
- 56975 - [SC - High] liquidation fee trapping in alchemistv3
- 57036 - [SC - High] unconditional debt reduction before protocol fee check in force repayment
- 56628 - [SC - High] liquidate does not update mytsharesdeposited that is reduced by fees
- 57954 - [SC - High] lackf of tracking of excess cover in earmark function leads to permanent loss of cover value and stuck user positions
- 57476 - [SC - High] forcerepay fails to decrement global cumulativeearmarked
- 57907 - [SC - High] incorrect forced repayment accounting allows debt forgiveness and frees locked collateral systemic loss
- 58387 - [SC - High] liquidator fee in the doliquidation function withheld when collateral is exhausted leading to seized fee trapped in protocol
- 56817 - [SC - High] forcerepay doesn t decrement mytsharesdeposited inflating tvl
- 58472 - [SC - High] liquidator base fee seized but not paid due to post deduction balance check
- 58354 - [SC - High] forcerepay does not decrement mytsharesdeposited causing a temporal blocking of new deposits
- 57995 - [SC - High] missing slippage protection in tokeautousdstrategy allocation function leads to permanent value loss
- 57760 - [SC - High] mytstrategy allocate deallocate doesnt account for profit and loss
- 56827 - [SC - High] missing global earmark reduction in forcerepay
- 56714 - [SC - High] accounting invariant violation in forcerepay leads to protocol insolvency
- 58782 - [SC - High] rewards earned by eulerarbusdcstrategy will not be withdrawable from euler pool on arbitrum
- 58275 - [SC - High] account rawlocked not clear even when debt is clear
- 57740 - [SC - High] eulereth strategy will have weth locked in the strategy contract
- 58771 - [SC - High] incorrect tracking of total deposited yield tokens mytsharesdeposited in liquidation and force repayment paths
- 57861 - [SC - High] missing slippage protection in tokemak autopool allocation functions leads to direct theft of user funds
- 57970 - [SC - High] forcerepay leaves cumulativeearmarked stale
- 56389 - [SC - High] mytsharesdeposited is not updated on liquidation outflows which could lead to solvency illusion and misreported global ratios
- 57148 - [SC - High] mytsharesdeposited variable is not correctly updated during liquidations leading to wrong assumptions and incorrect bad debt calculation in the transmuter
- 58736 - [SC - High] missing tvl accounting in forcerepay and doliquidation leads to protocol insolvency
- 57678 - [SC - High] liquidation fee is deducted from user but not paid to liquidator
- 58658 - [SC - High] cumulativeearmarked not updated
- 56845 - [SC - High] the deposit will be reverted because mytsharesdeposited references an outdated value
- 57972 - [SC - High] liquidation doesn t update mytsharesdeposited
- 58287 - [SC - High] mytsharesdeposited is not updated on some token transfer
- 58723 - [SC - High] cumulativeearmarked is not updated at forcerepay
- 58067 - [SC - High] asymmetric deallocation in tokeautoethstrategy leads to permanent weth funds stuck in strategy
- 58260 - [SC - High] inconsistent collateral accounting where force repay liquidation transfer out myt without adjusting tvl
- 57963 - [SC - High] incorrect mytsharesdeposited accounting in liquidate allows theft of user funds via corrupted bad debt ratio
- 57725 - [SC - High] alchemistv liquidate is not updating the mytsharesdeposited which makes it inflated and can cause deposits dos and liquidations malfunction that may cause protocol insolvency
- 56824 - [SC - High] missing update to mytsharesdeposited during liquidation
- 57196 - [SC - High] artificially inflated mytsharesdeposited in alchemixv3 sol deflates bad debt ratio in transmuter sol
- 58755 - [SC - High] users position that are synced at certain times overestimate collateralbalance of the position
- 58269 - [SC - High] liquidator fee not paid when fee equals surplus
- 58383 - [SC - High] due to cumulativeearmarked not being updated in alchemix forcerepay user funds are locked longer due to slower debt decay and calculation of system collaterization rate is inc
- 56902 - [SC - High] strategy adapter aavev3opusdcstrategy would not work well with atoken rebasing mechanism
- 58215 - [SC - High] funds can become permanently stuck in adapter when kill switch is enabled
- 56672 - [SC - High] inconsistent myt share accounting leads to under liquidation and solvency risk
- 58466 - [SC - High] liquidation fee payment failure due to redundant wrong collateral check
- 57544 - [SC - High] mytsharesdeposited is not reduced upon fee transfers to protocol
- 56673 - [SC - High] zero cost fee farming via forced earmarked repayment
- 58369 - [SC - High] missing mytsharesdeposited decrements in forcerepay doliquidation leads to smart contract unable to operate due to lack of token funds
- 57726 - [SC - High] alchemistv3 myt tvl accounting drift on liquidation forcerepay blocks deposits via depositcap medium smart contract unable to operate due to lack of token funds
- 58177 - [SC - High] transmuter claimredemption cant update mytsharesdeposited leading to permanent underlying value state inside alchemist
- 57152 - [SC - High] assets permanently locked due to killswitch flag
- 58754 - [SC - High] missing mytsharesdeposited decrements in alchemistv3 forcerepay doliquidation
- 58010 - [SC - High] slippage tolerance not enforced in tokeautousdstrategy
- 58266 - [SC - High] partial liquidation strands base fee due to post seizure balance check
- 56936 - [SC - High] missing mytsharesdeposited decrements on repay liquidation tvl drift false over collateralization and deposit cap dos
- 58113 - [SC - High] stargateethpoolstrategy realassets return false real assets
- 58337 - [SC - High] Incorrect Handling of cumulativeEarmarked in _forceRepay leads to inflated survival accumulator.
- 56923 - [SC - High] missing cumulativeearmarked update in forcerepay causes incorrect debt accounting in alchemistv3
- 58409 - [SC - High] high arithmetic underflow in mytstrategy sol s deallocate check prevents yield withdrawal
- 58435 - [SC - High] systemic accounting bug leads to protocol insolvency
- 57308 - [SC - High] alchemistv3 does not update mytsharesdeposited when performing liquidation causing global accounting and liquidation logic mismatch
- 57369 - [SC - High] deallocation may revert due to an underflow
- 57930 - [SC - High] allocation tracking underflow in strategy deallocation leads to protocol insolvency
- 58524 - [SC - High] when liquidating there are cases where the fee is not paid to the liquidator
- 58502 - [SC - High] deposit cap denial of service due to stale mytsharesdeposited during liquidation
- 58396 - [SC - High] total locked is not cleared proportionally to the total debt this forces the collateral weight to become incorrect and new users transmuter redeem repayment will repay more debt fo
- 56815 - [SC - High] missing mytsharesdeposited decrements in internal outflows cause tvl inflation deposit dos
- 58112 - [SC - High] a malicious user can avoid getting penalized upon a transmuter redemption by depositing and withdrawing collateral in the alchemist
- 57197 - [SC - High] incorrect totallocked reduction
- 56363 - [SC - High] mytsharesdeposited not correctly updated in all cases leading to incorrect protocol collateralization and reduced liquidation incentives
- 57918 - [SC - High] incorrect totallocked collateral accounting in alchemistv3
- 57825 - [SC - High] forced repay cover enables double counted debt reduction in redeem
- 57668 - [SC - High] missing collateral tracking update during liquidation leads to inflated total value calculation and delayed under collateralization protection
- 57464 - [SC - High] incorrect accounting in stargate strategy causes protocol insolvency and user liquidations
- 57532 - [SC - High] assets are not accounted for when the contract is in killswitch mode
- 57447 - [SC - High] untracked myt outflows inflate tvl causing liquidation suppression
- 58061 - [SC - High] incorrect collateral and fee check in doliquidation allows liquidator to loose fee
- 58035 - [SC - High] killswitch early return in strategy causes vault to adapter asset leakage mis accounting and deallocation dos
- 56442 - [SC - High] inflated totallocked because vault yield accrual would skew collateralweight calculation
- 57510 - [SC - High] stale locked collateral tracking during price appreciation causes disproportionate redemption losses
- 57745 - [SC - High] syn fails to update the rawlocked valuation leading to a loss of fund for users with rawlock 0 when total lock become 0
- 56545 - [SC - High] force repayment leaves stale global earmarks freezing transmuter redemptions
- 57883 - [SC - High] mytsharesdeposited updates in liquidation functions leads to critical tvl inflation
- 57172 - [SC - High] missing mytsharesdeposited decrements in liquidation flows causes accounting divergence
- 58799 - [SC - High] forcerepay does not reduce cumulativeearmarked which leads to wrong accounting users debts are incorrectly higher which can cause wrongful liquidations
- 58794 - [SC - High] hardcoded 0 amount as the minsharesout to depositmax function call does not provide slippage protection
- 58192 - [SC - High] tokeautoeth strategy tokens locked when autopool router enforces maxdeposit cap
- 58363 - [SC - High] accounting corruption in liquidations due to missing global counter update
- 56727 - [SC - High] underlying increase in forced repayments leads to insolvency
- 57041 - [SC - High] deallocation accounting mismatch between vault and adapter
- 58346 - [SC - High] forcerepay fails to decrement cumulativeearmarked breaking earmark invariant and skewing redemptions
- 57533 - [SC - High] inaccurate tvl calculation prevents liquidations leading to protocol insolvency risk
- 58530 - [SC - High] protocol insolvency via stale totallocked zeroed totallocked prevents collateralweight update in redeem leading to missed collateral haircut
- 58606 - [SC - High] Missing collateral accounting in liquidation leads to inflated bad debt calculations
- 56402 - [SC - High] killswitch leaves vault assets stranded and blocks withdrawals
- 58196 - [SC - High] aavev3arbusdcstrategy strategy will have its reward stuck in aave usdc
- 57559 - [SC - High] missing mytsharesdeposited decrement in liquidation paths enables theft of unclaimed yield and protocol insolvency
- 58070 - [SC - High] forced repay accounting lets borrowers erase debt without paying equivalent assets protocol deficit insolvency
- 58425 - [SC - High] missing slippage protection when depositing to tokeauto strategies
- 57553 - [SC - High] mytsharesdeposited is not updated in liquidations which breaks bad debt ratio alchemistcr calculations and causes failures in bad debt handling and liquidation handling
Medium
- 58427 - [SC - Medium] stargateethpoolstrategy allocate and deallocate inconsistent dust handling causes eth to be permanently locked in strategy contract
- 58751 - [SC - Medium] setminimumcollateralization allows for increasing the current minimumcollateralization instantly exposing users to risk of liquidation
- 58093 - [SC - Medium] morpho reward in morphoyearnogweth will be lost or stuck
- 58616 - [SC - Medium] liquidation can revert due to 0 amount fee withdraw
- 58291 - [SC - Medium] unlike setters collateralization functions alchemistv3 initialize doesnt enforce collateralization invariants allowing to break them
- 58722 - [SC - Medium] tokenauto strategy allocation uses maxdeposit which may allocate less than requested leaving any excess funds permanently locked
- 56692 - [SC - Medium] zeroxswapverifier verification will always revert due to wrong hardcoded execution function selectors
- 56522 - [SC - Medium] tokeautousdstrategy allocate and tokeautoethstrategy allocate may suffer a denial of service dos due to token amount mismatch in autopilotrouter depositmax
- 57565 - [SC - Medium] the amount of dust will be permanently locked in stargateethpoolstrategy
- 57017 - [SC - Medium] aavev3arbwethstrategy cant claim aave incentive
- 57096 - [SC - Medium] the implementation of tokeautoeth allocate is incorrect
- 57957 - [SC - Medium] loss of eulereth vault yields for euler weth strategy
- 56706 - [SC - Medium] stargateethpoolstrategy incomplete eth wrapping causes withdrawal dos
- 57771 - [SC - Medium] fee not collected in forcerepay when should
- 58087 - [SC - Medium] moonwellusdcstrategy ignores redeemunderlying error codes temporary freezing of funds withdrawals revert
- 57167 - [SC - Medium] missing claim function in euler and morpho strategies leads to loss of yield rewards
- 56800 - [SC - Medium] Minimum collateral change lets liquidators seize compliant accounts
- 58515 - [SC - Medium] a liquidated position can end the liquidation process still below collateralizationlowerbound allowing for double liquidation of positions
- 57272 - [SC - Medium] silent failures on moonwell deposit are not catched by strategy
- 56839 - [SC - Medium] moonwell strategies fail to check compound error codes causing silent allocation failures
- 58273 - [SC - Medium] incorrect hardcoded 0x settler function selectors
- 57511 - [SC - Medium] protocol could atleast be taking a part of the protocol fee
- 58209 - [SC - Medium] lack of slippage protection in transmuter claimredemption and alchemistv3 withdraw leads to user yield losses
- 56751 - [SC - Medium] stargateethpoolstrategy deallocate function redeem less weth than expected
- 56859 - [SC - Medium] lp underlying mismatch in stargateethpoolstrategy deallocate causes withdrawal dos
- 57770 - [SC - Medium] admin can bypass permissionedcalls protection using multicall
- 56737 - [SC - Medium] the return value of mint is not checked
- 58203 - [SC - Medium] moonwell strategies silent failure due to unchecked mint and redeemunderlying return values
- 56846 - [SC - Medium] liquidation will return because of insufficient funds
- 57335 - [SC - Medium] zero min out erc 4626 deposits cause under mint and permanent allocation loss
- 58105 - [SC - Medium] zeroxswapverifier decodes execute payload with wrong abi bytes vs bytes temporary freezing of funds
- 58403 - [SC - Medium] missing checks for transaction return values in moonwell strategies
- 57788 - [SC - Medium] Missing _claimRewards() Implementation in AaveV3ARBUSDCStrategy Leads to Permanent Loss of Aave Incentive Rewards
- 58115 - [SC - Medium] incorrect weth deposit amount prevents deposited eth through receive function to cover strategy loss
- 56873 - [SC - Medium] incorrect eth wrapping condition in moonwellwethstrategy deallocate leads to temporary freezing of funds
- 58313 - [SC - Medium] incorrect allocation accounting and dust handling in stargateethpoolstrategy causes systematic loss cap mis accounting and deallocation reverts
- 58787 - [SC - Medium] when allocation amount is greater than the maxdeposit of tokeautoeth sol the remaining is stuck in tokeautoeth sol
- 58006 - [SC - Medium] MoonwellUSDCStrategy._allocate ignores Compound-style mint failures and corrupts vault accounting
- 58185 - [SC - Medium] incorrect survivalaccumulator accounting logic after earmarkweight reaches 128 breaks core system invariants and can lead to protocol insolvency
- 56878 - [SC - Medium] the permissionedcalls check can be bypass
- 57227 - [SC - Medium] unchecked return codes in moonwellusdcstrategy leading to stuck funds
- 58730 - [SC - Medium] an attacker can prevent any tokenauto strategy allocation by making a donation to the vault of as little as 1 wei of underlying token
- 57752 - [SC - Medium] aave and euler incentives for myt will be lost due to unimplemented claimrewards function
- 58334 - [SC - Medium] incorrect function selectors
- 56960 - [SC - Medium] missing slippage protection during redemption execution lead to loss of token for user
- 58456 - [SC - Medium] account can enter unliquidatable state with residual debt
- 58231 - [SC - Medium] attacker can stop protocol from allocating assets to the autoeth vaults
- 58022 - [SC - Medium] accounting mismatch and fund stuck due to dust eth on stargateethpoolstrategy
- 58239 - [SC - Medium] missing aave incentives rewards claiming mechanism leads to permanent loss of protocol royalties
- 58645 - [SC - Medium] incorrect weth wrapping amount in moonwellwethstrategy deallocate wraps ethredeemed instead of amount
- 57867 - [SC - Medium] zeroxswapverifier erroneously rejects uniswap v3 swaps due to an an incorrect selector
- 57311 - [SC - Medium] moonwell allocation and deallocation can fail silently causing incorrect state updates and loss of yield
- 56927 - [SC - Medium] setminimumcollateralization function also needs a another check
- 58080 - [SC - Medium] aave v3 strategies fail to claim op arb liquidity mining rewards causing permanent loss of yield
- 58741 - [SC - Medium] action function signatures to 0x settler are wrong
- 58033 - [SC - Medium] unimplemented claimrewards function results in permanent freezing of aave incentive rewards
- 56855 - [SC - Medium] liquidations fail with arithmetic underflow when forced repayment exhausts collateral
- 58130 - [SC - Medium] asymmetric validation in collateralization setters allows protocol misconfiguration breaking all borrowing
- 57812 - [SC - Medium] no function to claim aave incentives
- 57183 - [SC - Medium] missing incentive rewards claiming in multiple strategy contracts
- 58707 - [SC - Medium] moonwell strategy allocate does not revert when mint fails which can result in a sudden drop in myt share price and consequently sever under collateralization
- 58773 - [SC - Medium] in stargate incorrect allocation cap accounting leading to unnecessary dos
- 58492 - [SC - Medium] unbounded deposit exposure in tokeautoethstrategy allocate
- 58449 - [SC - Medium] tokeautoeth strategy balance approval mismatch dos
- 56775 - [SC - Medium] permanent freezing of funds from precision dust strict deallocation check
- 57331 - [SC - Medium] Conditional ETH Wrapping Logic Causes Withdrawal DoS in MoonwellWETH and StargateETH Strategies
- 58728 - [SC - Medium] when the strategy is at a loss the assets cannot be withdrawn
- 56982 - [SC - Medium] incorrect function selectors used in zeroxswapverifier
- 57483 - [SC - Medium] fees could be skipped when there is not enough collateral
- 58611 - [SC - Medium] double counting of earmarked debt repayments as cover leads to user funds being stuck and protocol insolvency
- 58718 - [SC - Medium] in forcerepay protocol fee collection leads to theft of unclaimed yield
- 58605 - [SC - Medium] missing claimrewards in aavev3arbusdcstrategy leads to permanent freezing of accrued aave incentives
- 58081 - [SC - Medium] missing check in function alchemistv3 setminimumcollateralization could lead to set minimumcollateralization globalminimumcollateralization
- 58336 - [SC - Medium] additive update to survival accumulator causing overflow
- 58181 - [SC - Medium] a griefer can cause a permanent dos in tokeautoeth tokeautousdcstrategy allocate
- 58639 - [SC - Medium] off by one issue in the forcerepay function causes protocol to lose funds in the form of protocol fee
- 58168 - [SC - Medium] safe position liquidation vulnerability in alchemistv3 when minimumcollateralization equals collateralizationlowerbound
- 57646 - [SC - Medium] ABI Signature Mismatch in ZeroXSwapVerifier Causes Complete Failure to Verify Legitimate 0x Settler Transactions
- 57526 - [SC - Medium] StargateEthPoolStrategy rounding mismatch freezes VaultV2 allocations
- 57545 - [SC - Medium] stargate eth strategy rounding bug
Low
- 58607 - [SC - Low] incorrect access control in admin ownership transfer allows only current admin to accept ownership instead of pending admin
- 57644 - [SC - Low] unenforced cap logic in alchemistallocator allows not controlled allocations
- 58329 - [SC - Low] incorrect balance measurement in morphoyearnogweth deallocate leads to temporary freezing of funds via spurious loss events
- 58007 - [SC - Low] pendingadmin cannot call acceptadminownership to accept admin role
- 57057 - [SC - Low] wrong order of balance checks in morphoyearnogwethstrategy
- 57473 - [SC - Low] inverted comparison operator allows operators admin level allocation privileges
- 58749 - [SC - Low] incorrect balance snapshot
- 58190 - [SC - Low] operator has no allocation restrictions in alchemistallocator https github com alchemix finance v3 poc blob a192ab313c81ba3ab621d9ca1ee000110fbdd1e9 src alchemistallocator sol
- 57665 - [SC - Low] incorrect balance measurement in deallocate function of morphoyearnogwethstrategy
- 58089 - [SC - Low] arithmetic underflow revert in deallocate
- 56633 - [SC - Low] access control flaw in acceptadminownership prevents secure admin transfer leading to potential permanent loss of curator control
- 58778 - [SC - Low] zeroxswapverifier implements incorrect data extraction logic enabling verification bypass in future strategy integrations
- 57090 - [SC - Low] ownership transfer failure in alchemistcurator https github com alchemix finance v3 poc blob immunefi audit src alchemistcurator sol prevents future dao governance or recovery
- 57697 - [SC - Low] missing recipient from checks in zeroxswapverifier enable direct asset theft
- 56451 - [SC - Low] alchemistallocator allocate and deallocate do not enforce cap checks as intended
- 56947 - [SC - Low] flawed access control in alchemistcurator admin transfer pattern leads to risk of permanent loss of control
- 58257 - [SC - Low] in tokeautoeth deallocate can be dosed if the vault incuring losses
- 58410 - [SC - Low] tokemak strategy deallocation causes toke token lockup
- 58462 - [SC - Low] incorrect post withdraw balance measurement causes false loss reporting and mis accounting in morphoyearnogwethstrategy deallocate
- 56583 - [SC - Low] wrong 2 step transferadminownership logic and insufficient checks in alchemistcurator sol leads to permanent admin ownership loss
- 58345 - [SC - Low] operators in alchemistallocator sol can allocate higher than dao defined limits
- 58110 - [SC - Low] morphoyearnogwethstrategy will always report strategy loss
- 58424 - [SC - Low] morphoyearnogweth strategy balance check order bug
- 57975 - [SC - Low] broken admin rotation in acceptadminownership causes permanent governance lockout
- 58469 - [SC - Low] pending admin cannot accept ownership
- 58473 - [SC - Low] wrong redeemed amount calculation in morphoyearnogweth strategy
- 58077 - [SC - Low] reward tokens are incorrectly claimed to strategy contract during deallocation leads to permanent token loss
- 58348 - [SC - Low] zeroxswapverifier accepts malicious 0x calldata recipient not bound minout ignored transferfrom misused attacker can route strategy vault funds to self direct theft
- 57067 - [SC - Low] overstated per account locked collateral due to global clamp in subdebt
- 58198 - [SC - Low] broken two step admin transfer pattern
- 58578 - [SC - Low] zeroxswapverifier allows attackers to drain strategy tokens via crafted calldata
- 57534 - [SC - Low] small debt positions cannot be liquidated due to zero amount checks on token vaults
- 56418 - [SC - Low] two step owner transfer is broken and can lead to unforseen damages
- 58289 - [SC - Low] missing addresses verification in zeroxswapverifier
- 58051 - [SC - Low] incorrect access control in acceptadminownership
- 57079 - [SC - Low] h 1 morphoyearnogweth strategy incorrect balance measurement order in deallocate causes dos on withdrawals with any loss
- 58796 - [SC - Low] incorrect balance snapshot in deallocate causes wethredeemed always 0
- 58714 - [SC - Low] pending admin cannot accept ownership in alchemistcurator sol
- 58575 - [SC - Low] operator limit bypass
- 56324 - [SC - Low] missing from owner check in transferfrom verifier direct theft of user funds
- 58002 - [SC - Low] missing submitremovestrategy function
- 57749 - [SC - Low] zeroxswapverifier misses critical sender recipient minout validations allowing malicious 0x calldata to drain funds critical direct theft
- 58143 - [SC - Low] unused cap enforcement variables adjusted
- 57866 - [SC - Low] failure to verify the recipient s address can result in the theft of purchased tokens
- 58352 - [SC - Low] assets become permanently stuck in tokeautoeth strategy due to strict balance check
- 58423 - [SC - Low] pending admin cannot accept ownership transfer in alchemistcurator
- 56911 - [SC - Low] incorrectly implemented two step admin ownership transfer mechanism prevents new admin to accept role
- 57514 - [SC - Low] calldata verification bypass in 0x preflight logic enables arbitrary from recipient manipulation and direct fund theft
- 57637 - [SC - Low] acceptadminownership doesn t allow expected user approval
- 58419 - [SC - Low] alchemistcurator two step ownership transfer mis implemented
- 58120 - [SC - Low] incorrect balance measurement in morphoyearnogweth strategy leads to incorrect deallocation loss registering
- 56689 - [SC - Low] reward token toke is stuck in myt
- 58542 - [SC - Low] [Low] Logic Error in MorphoYearnOGWETHStrategy._deallocate(): wethRedeemed Always Zero → All Deallocations Emit StrategyDeallocationLoss
- 57622 - [SC - Low] lack of claimed reward handling in myt strategies will keep all external token rewards stuck forever
- 57169 - [SC - Low] zeroxswapverifier policy bypass via rfq filldata prefix token amount spoof
- 57621 - [SC - Low] improper reward claiming in tokeautoethstrategy sends toke tokens to wrong address causing permanent freezing of unclaimed yield
- 57328 - [SC - Low] once tokelockduration is the opposite of zero in tokeautoethstrategy accumulated rewards in acctoke can be stuck
- 56961 - [SC - Low] incorrect balance snapshot check in deallocate logs false deallocation loss in morphoyearnogweth strategy
- 58734 - [SC - Low] broken strategy realassets calculation
- 57982 - [SC - Low] permanently stuck rewards in the vault
- 58400 - [SC - Low] alchemist allocator does not actually enforce caps
- 57114 - [SC - Low] inherited setadmin function allows to bypass two step admin ownership transfer mechanism
- 58133 - [SC - Low] toke rewards permanently locked in strategy adapter
- 58555 - [SC - Low] alchemistcurator 2 step ownership transfer is implemented incorrectly
- 58590 - [SC - Low] incorrect balance read ordering in morphoyearnogwethstrategy deallocate
- 58210 - [SC - Low] incorrect balance measurement in deallocation disables loss detection in morphoyearnogweth
- 57546 - [SC - Low] moonwellusdcstrategy fail to claim its reward from moonwell comptroller
- 58078 - [SC - Low] access control bypass in zeroxswapverifier missing owner validation
- 57439 - [SC - Low] incorrect baddebtratio rounding in transmuter claimredemption may cause funds to become permanently stuck
- 57123 - [SC - Low] incorrect 2 step ownership in alchemistcurator
- 58488 - [SC - Low] tokeautousdstrategy claims rewards to itself automatically when deallocate is called but since reward token is tokemak the rewards remain permanently locked
- 56882 - [SC - Low] missing cap enforcement in alchemistallocator allows operators to bypass risk controls
- 56909 - [SC - Low] incorrect balance snapshot in strategy deallocation causes false loss events and masks real shortfalls
- 56602 - [SC - Low] function takes incorrect modifier
- 58709 - [SC - Low] naive 0x fill parsing lets attackers spoof token and amount checks
- 58408 - [SC - Low] underflow account rawlocked on subdebt due to rounding inconsistency
- 57316 - [SC - Low] Allocation Cap Enforcement Missing & DeadCode
- 58743 - [SC - Low] zeroxswapverifier recipient validation bypass
- 58666 - [SC - Low] recipient owner not enforced in action verifiers enables theft of swap proceeds
- 56625 - [SC - Low] broken ownership transfer logic in alchemistcurator permanently freezes contract operations
- 57746 - [SC - Low] broken contract ownership logic at alchemistv3 sol
- 57964 - [SC - Low] improper validation of absolutecap and relativecap enables excessive fund allocation in alchemistallocator
- 57983 - [SC - Low] direct asset drain via zeroxswapverifier bypass and mytstrategy unlimited permit2 approvals
- 57989 - [SC - Low] broken isvalidsignature leads to fund freezing
- 56383 - [SC - Low] the alchemistcurator acceptadminownership can t be called by the pending admin and if the function is called without pending admin the admin rigths will be lost
- 58480 - [SC - Low] Missing recipient and token binding in verifySwapCalldata leads to unauthorized fund transfers
- 58512 - [SC - Low] mytstrategy isvalidsignature is implemented wrong and will not work
- 57394 - [SC - Low] acceptAdminOwnership() only allows the current admin to finalise transfers
- 58497 - [SC - Low] the amount of weth redeemed is not calculated properly in morphoyearnogweth
- 56517 - [SC - Low] zeroxswapverifier validates struct but executes external actions enabling direct fund theft
- 58648 - [SC - Low] incorrect wethbalancebefore read causes broken loss detection in deallocation
- 57127 - [SC - Low] pending admin should call the function instead of admin
- 58418 - [SC - Low] verifyswapcalldata cant verify the output token of the swap
- 56830 - [SC - Low] broken admin ownership transfer logic acceptadminownership requires current admin instead of pending admin blocking role claim
- 58249 - [SC - Low] broken two step admin handover in alchemistcurator
- 58516 - [SC - Low] inverted min max logic in alchemistallocator operator cap calculation
- 57777 - [SC - Low] zerox swap verifier bypass enables direct theft of user funds
- 58527 - [SC - Low] complete loss of all reward value on tokeautoethstrategy claimrewards
- 58376 - [SC - Low] claimrewards function permanently locks earned toke reward token on morpho vaultv2
- 56887 - [SC - Low] incorrect balance tracking in morphoyearnogwethstrategy deallocate function leads to wrong loss event emission resend
- 58579 - [SC - Low] inconsistent admin management implementation in alchemistcurator sol
- 58333 - [SC - Low] incorrect onlyadmin modifier in acceptadminownership
- 58520 - [SC - Low] pending admin cannot accept ownership
- 56962 - [SC - Low] balance check logic error in deallocate function leads to broken loss detection and false event emissions
- 57625 - [SC - Low] incorrect cover accounting in earmark leads to earmarking failure and value leakage
- 58636 - [SC - Low] broken two step admin transfer prevents legitimate admin succession in alchemistcurator
- 56343 - [SC - Low] morphoyearnogweth deallocate function always emits strategydeallocationloss due to flawed balance measurement
- 58088 - [SC - Low] inadequate enforcement of global cap enables cumulative over allocation
- 56465 - [SC - Low] gettotaldeposited doesn t reflect the correct total deposited
- 56983 - [SC - Low] tokemak rewards sent to myt vault contract not strategy rewards stranded
- 58422 - [SC - Low] morphoyearn og weth strategy always emits deallocation loss event due to zero delta calculation
- 58357 - [SC - Low] permanent freezing of tokeautoeth strategy rewards in myt vault
- 57479 - [SC - Low] logical bug in alchemistcurator acceptadminownership asking to current admin to accept ownership
- 56709 - [SC - Low] zeroxswapverifier missing source validation
- 58672 - [SC - Low] incorrect balance check sequence
- 58705 - [SC - Low] mismatch between emitted protocol fee and actual fee paid in forcerepay due to strict inequality check
- 58627 - [SC - Low] incorrect delta calculation in deallocate causes wethredeemed to always be zero
- 57024 - [SC - Low] wethbalancebefore is computed after withdrawal in deallocate function in morphoyearnogwethstrategy contract leading to systematic strategydeallocationloss event emission
- 58360 - [SC - Low] round down calculation in converttoshares leads to deallocation failure in tokeautoeth strategy
- 58259 - [SC - Low] broken operator logic inside alchemistcurator
- 57599 - [SC - Low] protocol wrongly withdraws before checking balance of withdraw
- 58244 - [SC - Low] incorrect balance check order in morphoyearnogweth strategy leads to false deallocation loss events
- 58604 - [SC - Low] verification bypass in verifyexecutemetatxncalldata enables arbitrary 0x actions to pass checks and execute in the zeroxswapverifier sol contract
- 56498 - [SC - Low] reserve drainage due to incorrect balance measurement
- 58325 - [SC - Low] operator can shift vault funds to risky strategies without oversight leading to potential loss of user funds
- 58386 - [SC - Low] rewards claimed during deallocation remain stranded on strategy and unaccounted
- 56832 - [SC - Low] alchemistcurator contract doesn t allow to remove strategies from the myt morpho v2 vault
- 58310 - [SC - Low] strategy fluidarbusdcstrategy cant claim fluid token reward
- 56529 - [SC - Low] incorrect token balance calculation in morphoyearnogwethstrategy sol deallocate leads to wrong event emitted every time
- 58428 - [SC - Low] toke reward loss when calling deallocate
- 58056 - [SC - Low] the auto eth and usdc staking rewards will stuck in vault
- 56836 - [SC - Low] ownership transfer failure in alchemistcurator https github com alchemix finance v3 poc blob immunefi audit src alchemistcurator sol prevents future dao governance or recovery
- 57862 - [SC - Low] incorrect balancebefore reading order in morphoyearnogwethstrategy deallocate function leads to wrong event emission
- 58040 - [SC - Low] removestrategy is non functional
- 57837 - [SC - Low] moonwellwethstrategy cant claim reward from moonwell comptroller
- 58079 - [SC - Low] missing from validation in zeroxswapverifier verifyswapcalldata enables direct theft of approved funds
- 58797 - [SC - Low] the tokeauto strategies implementation does not accurately report the actual assets held by the strategy
- 58642 - [SC - Low] Cap Bypass in AlchemistAllocator.deallocate() Allows Over-Deallocation Beyond Computed Limits
- 58189 - [SC - Low] two step mechanism to transfer ownership is broken due to incorrect access control
- 58322 - [SC - Low] incorrect emit due to wrong ordering of wethbalancebefore calculation
- 57516 - [SC - Low] arbitrary external call in zeroxswapverifier leads to theft of unclaimed yield
- 56332 - [SC - Low] pending admin cannot accept ownership
- 58362 - [SC - Low] users will lose tokemak rewards earned in tokeautoethstrategy
- 56893 - [SC - Low] pending admin cannot accept ownership in alchemistcurator
- 58124 - [SC - Low] direct theft of funds via malicious actions in execute call due to incorrect calldata verification
- 57926 - [SC - Low] the conditional strategydeallocationloss event in morphoyearnogwethstrategy deallocate gets logged all the time due a misplacement in variable declaration
- 57806 - [SC - Low] staking graph argument bounds are incorrectly defined
- 57251 - [SC - Low] curator cannot remove adapter due to timelock requirement
- 57346 - [SC - Low] alchemistallocator compares incompatible units asset wei vs wad percentage
- 56582 - [SC - Low] alchemistcurator removestrategy is unable to remove strategies from vaults due to wrong logic implementation
- 58506 - [SC - Low] adjusted cap limits are never enforced
- 58149 - [SC - Low] morphoyearnogweth incorrectly reports loss and triggers strategydeallocationloss event
- 58393 - [SC - Low] wrong order in balance querying instructions in morphoyearnogwethstrategy deallocate function leads to always emit strategydeallocationloss event
- 58513 - [SC - Low] broken access control in alchemistcurator acceptadminownership prevents admin transfer
- 58416 - [SC - Low] unclaimed extra rewards in tokemak integration lead to permanent freezing of yield
Insight
- 56347 - [SC - Insight] burn contains redundant calculations
- 56561 - [SC - Insight] fee amount is recomputed multiple times when the initial value has already been cached
- 57923 - [SC - Insight] redundant synthetic transfers in claimredemption when amountnottransmuted is zero
- 56368 - [SC - Insight] alchemisttokenvault deposit should use safetransferfrom instead of transferfrom alchemisttokenvault withdraw should use safetransfer instead of transfer
- 58762 - [SC - Insight] manipulation of feeinunderlying through front running during liquidations on ethereum
- 56494 - [SC - Insight] gas optimization redundant external calls in strategy deallocate functions
- 58735 - [SC - Insight] calculateliquidation reverts due to divide by zero if targetcollateralization fixed point scalar
- 58739 - [SC - Insight] decimals mismatch causes 1e12 under reporting in strategy returns letting allocations silently exceed per strategy and global caps
- 56949 - [SC - Insight] uncapped collateral transfer in redemption leads to accounting discrepancy enabling theft of user funds
- 56346 - [SC - Insight] redundant calculation of feeamount in repay function
- 57448 - [SC - Insight] unnecessary computation of lockedcollateral in adddebt and subdebt
- 56348 - [SC - Insight] incorrect apy calculation in mytstrategy approxapy causes underreported yields
- 58667 - [SC - Insight] permit2 is approved the wrong asset which leads to loss of funds or failing swaps
- 56350 - [SC - Insight] implementation contract alchemistv3 not locked disableinitializers missing
- 56730 - [SC - Insight] transmuter tokenuri is not eip 721 compliance
- 58703 - [SC - Insight] cached interest rate calculation in peapodseth strategy leads to inaccurate apr apy estimates
- 58076 - [SC - Insight] Fix unit mismatch in _doLiquidation: collateralInUnderlying -> collateralInDebt
- 58146 - [SC - Insight] Whitelist can be disabled repeatedly, contradicting intended program behavior.
- 57791 - [SC - Insight] receipt token misconfiguration in aave strategies
- 56462 - [SC - Insight] unused mapping causes unnecessary storage gas consumption
- 58719 - [SC - Insight] insight gas optimization save gas by using the cached fee amount in burn and repay in alchemist sol
- 58356 - [SC - Insight] the alchemist tokeauto strategies doesn t use recommended best practice by tokeauto
- 56336 - [SC - Insight] stargateethpoolstrategy deallocate would emit false deallocating loss event in some cases
- 56328 - [SC - Insight] redundant require statement in eulerusdcstrategy deallocate function leads to unnecessary gas consumption
- 56806 - [SC - Insight] broken withdrawal logic in aavev3arbwethstrategy permanently locks user funds
- 57563 - [SC - Insight] reward tokens being permanently frozen in tokeautousdstrategy
- 58552 - [SC - Insight] single transfer instead of multiple saves gas
- 56572 - [SC - Insight] aave v3 lending pool is immutable in aave strategies
- 56406 - [SC - Insight] getestimatedyield never updates after snapshots
- 58094 - [SC - Insight] autopooleth vault slippage during lp token liquidation leads to temporary fund freezing
- 57606 - [SC - Insight] attacker can dos deposits by hitting the deposit cap
- 56658 - [SC - Insight] transmuter s tokenuri does not revert for nonexistent tokenids
- 56895 - [SC - Insight] function approvemint is vulnerable to race conditions
- 57208 - [SC - Insight] it is possible to prevent lowering the deposit cap by front running
- 57291 - [SC - Insight] hardcoded slippage in myt strategy
- 57028 - [SC - Insight] wrong amount variable in repay event
- 56621 - [SC - Insight] broken withdrawal logic in aavev3arbusdcstrategy permanently locks user funds
- 56518 - [SC - Insight] claimwithdrawalqueue discards claimed amount
- 56326 - [SC - Insight] variable could be immutable
- 56427 - [SC - Insight] src utils permissionedproxy sol setpermissionedcall incomplete event emission because it doesnt include value argument for signature
- 56528 - [SC - Insight] unbounded slippagebps can freeze withdrawals
- 57832 - [SC - Insight] cap logic error in alchemistallocator
- 56801 - [SC - Insight] function burn could be gas optimized
- 57969 - [SC - Insight] lack of incentive to liquidate small positions can cause the system to accumulate bad debt
- 57816 - [SC - Insight] critical incentive failure in calculateliquidation leads to protocol insolvency risk during global bad debt
- 58326 - [SC - Insight] the value of the burned peapods share token may exceed expectations
- 57522 - [SC - Insight] usecurrent flag ignored in preview functions in moonwell strategies
Reports by Type
Smart Contract
- 58427 - [SC - Medium] stargateethpoolstrategy allocate and deallocate inconsistent dust handling causes eth to be permanently locked in strategy contract
- 58607 - [SC - Low] incorrect access control in admin ownership transfer allows only current admin to accept ownership instead of pending admin
- 57644 - [SC - Low] unenforced cap logic in alchemistallocator allows not controlled allocations
- 58742 - [SC - High] liquidators will not earn fees in some cases
- 57378 - [SC - High] impossible to withdraw yield from strategies
- 58329 - [SC - Low] incorrect balance measurement in morphoyearnogweth deallocate leads to temporary freezing of funds via spurious loss events
- 58007 - [SC - Low] pendingadmin cannot call acceptadminownership to accept admin role
- 58395 - [SC - High] repayment fee exit leaves mytsharesdeposited inflated hiding protocol insolvency
- 58763 - [SC - High] accounting is broken when redeem is bypassed due to transmuter balance
- 57138 - [SC - Critical] protocol subsidizes repayment fees during liquidation
- 56347 - [SC - Insight] burn contains redundant calculations
- 56561 - [SC - Insight] fee amount is recomputed multiple times when the initial value has already been cached
- 58768 - [SC - High] mytsharesdeposited is not updated during liquidations breaking core accounting
- 58751 - [SC - Medium] setminimumcollateralization allows for increasing the current minimumcollateralization instantly exposing users to risk of liquidation
- 57662 - [SC - Critical] portion of users alasset amount that staked in transmuter can be lost forever when amount cumulativeearmarked
- 57057 - [SC - Low] wrong order of balance checks in morphoyearnogwethstrategy
- 58093 - [SC - Medium] morpho reward in morphoyearnogweth will be lost or stuck
- 58759 - [SC - High] yield stuck in adapter contracts forever
- 56435 - [SC - Critical] alchemistv3 repayment only liquidation pays liquidator from pool fee leak theft of unclaimed yield
- 57923 - [SC - Insight] redundant synthetic transfers in claimredemption when amountnottransmuted is zero
- 58616 - [SC - Medium] liquidation can revert due to 0 amount fee withdraw
- 56359 - [SC - High] permanent deposit freeze after forcerepay misaccounts freed shares
- 56552 - [SC - High] liquidation fee misrouting in alchemistv3 doliquidation leads to theft of unclaimed yield liquidator fee stranded
- 56368 - [SC - Insight] alchemisttokenvault deposit should use safetransferfrom instead of transferfrom alchemisttokenvault withdraw should use safetransfer instead of transfer
- 57473 - [SC - Low] inverted comparison operator allows operators admin level allocation privileges
- 58749 - [SC - Low] incorrect balance snapshot
- 56560 - [SC - High] liquidation base fee transfer is gated by a condition that s usually false
- 58291 - [SC - Medium] unlike setters collateralization functions alchemistv3 initialize doesnt enforce collateralization invariants allowing to break them
- 58190 - [SC - Low] operator has no allocation restrictions in alchemistallocator https github com alchemix finance v3 poc blob a192ab313c81ba3ab621d9ca1ee000110fbdd1e9 src alchemistallocator sol
- 58150 - [SC - High] missing slippage protection in tokeautousdstrategy allocate leads to direct theft of user funds via mev sandwich attacks
- 57665 - [SC - Low] incorrect balance measurement in deallocate function of morphoyearnogwethstrategy
- 58089 - [SC - Low] arithmetic underflow revert in deallocate
- 58722 - [SC - Medium] tokenauto strategy allocation uses maxdeposit which may allocate less than requested leaving any excess funds permanently locked
- 56692 - [SC - Medium] zeroxswapverifier verification will always revert due to wrong hardcoded execution function selectors
- 57102 - [SC - High] TVL Overstatement from _mytSharesDeposited Desync Enables Softened Liquidations & No‑Haircut Over‑Redemptions (Transmuter)
- 58762 - [SC - Insight] manipulation of feeinunderlying through front running during liquidations on ethereum
- 56633 - [SC - Low] access control flaw in acceptadminownership prevents secure admin transfer leading to potential permanent loss of curator control
- 58036 - [SC - Critical] incorrect fee deduction may drain collateral pool when account balance is insufficient
- 57129 - [SC - High] missing mytsharesdeposited decrement in liquidation functions causes permanent tvl inflation
- 58778 - [SC - Low] zeroxswapverifier implements incorrect data extraction logic enabling verification bypass in future strategy integrations
- 57090 - [SC - Low] ownership transfer failure in alchemistcurator https github com alchemix finance v3 poc blob immunefi audit src alchemistcurator sol prevents future dao governance or recovery
- 57360 - [SC - Critical] unreconciled repayment fee transfer enables myt overpayment and tvl inflation
- 57697 - [SC - Low] missing recipient from checks in zeroxswapverifier enable direct asset theft
- 56451 - [SC - Low] alchemistallocator allocate and deallocate do not enforce cap checks as intended
- 56956 - [SC - High] lack of slippage control in tokemak strategies can make myt suffer losses on allocation
- 56947 - [SC - Low] flawed access control in alchemistcurator admin transfer pattern leads to risk of permanent loss of control
- 56522 - [SC - Medium] tokeautousdstrategy allocate and tokeautoethstrategy allocate may suffer a denial of service dos due to token amount mismatch in autopilotrouter depositmax
- 58257 - [SC - Low] in tokeautoeth deallocate can be dosed if the vault incuring losses
- 57530 - [SC - High] stale tvl accounting in liquidations leads to protocol insolvency
- 56516 - [SC - High] allocate assets in killswitch mode can lead to assets stuck on contract
- 58410 - [SC - Low] tokemak strategy deallocation causes toke token lockup
- 58462 - [SC - Low] incorrect post withdraw balance measurement causes false loss reporting and mis accounting in morphoyearnogwethstrategy deallocate
- 56583 - [SC - Low] wrong 2 step transferadminownership logic and insufficient checks in alchemistcurator sol leads to permanent admin ownership loss
- 58345 - [SC - Low] operators in alchemistallocator sol can allocate higher than dao defined limits
- 58110 - [SC - Low] morphoyearnogwethstrategy will always report strategy loss
- 58424 - [SC - Low] morphoyearnogweth strategy balance check order bug
- 57975 - [SC - Low] broken admin rotation in acceptadminownership causes permanent governance lockout
- 58163 - [SC - Critical] total loss of user funds in claim redemption
- 57604 - [SC - High] nominal accounting mismatch in moonwell strategies leads to permanent locking of all generated yield
- 58469 - [SC - Low] pending admin cannot accept ownership
- 57565 - [SC - Medium] the amount of dust will be permanently locked in stargateethpoolstrategy
- 57860 - [SC - High] incorrect mytsharesdeposited accounting inflates collateral and underreports bad debt enabling insolvency
- 58534 - [SC - High] zero slippage protection in toke strategies allocation
- 58473 - [SC - Low] wrong redeemed amount calculation in morphoyearnogweth strategy
- 58724 - [SC - Critical] partial redemption burns full position accounting desynchronization and potential underpayment in transmuter claimredemption
- 58615 - [SC - High] mytsharesdeposited didn t get updated after forcerepay doliquidation called
- 58098 - [SC - High] there is a problem from ledger tvl sesync inliquidations cause a under liquidation and systemic insolvency risk
- 56494 - [SC - Insight] gas optimization redundant external calls in strategy deallocate functions
- 57017 - [SC - Medium] aavev3arbwethstrategy cant claim aave incentive
- 58077 - [SC - Low] reward tokens are incorrectly claimed to strategy contract during deallocation leads to permanent token loss
- 57096 - [SC - Medium] the implementation of tokeautoeth allocate is incorrect
- 57957 - [SC - Medium] loss of eulereth vault yields for euler weth strategy
- 58338 - [SC - Critical] alchemistv3 repayment fee can exceed remaining collateral leading to position insolvency
- 58780 - [SC - High] weth yield will be locked on aaveweth pool on arbitrum
- 58735 - [SC - Insight] calculateliquidation reverts due to divide by zero if targetcollateralization fixed point scalar
- 58526 - [SC - High] missing accounting update in liquidation functions leads to permanent dos on deposits
- 58683 - [SC - Critical] there is an issue in earmarked debt eeduction in the repay can causes a permanent fund freeze
- 58471 - [SC - High] accounting error in forcerepay doliquidation overstates tvl enabling under scaled redemptions and potential insolvency
- 58116 - [SC - High] tvl accounting mismatch leading to protocol insolvency
- 57506 - [SC - High] force repay don t update cumulativeearmarked variable
- 58348 - [SC - Low] zeroxswapverifier accepts malicious 0x calldata recipient not bound minout ignored transferfrom misused attacker can route strategy vault funds to self direct theft
- 56519 - [SC - Critical] unchecked repayment fee transfer in liquidate pays liquidators from other users collateral
- 57977 - [SC - High] inconsistent rawlocked state of a user after subdebt leads to irrecoverable user collateral loss
- 57590 - [SC - Critical] double counted transmuter cover in redeem allows overstated redemptions and potential over withdraw over borrow
- 56706 - [SC - Medium] stargateethpoolstrategy incomplete eth wrapping causes withdrawal dos
- 58635 - [SC - High] cumulativeearmarked is not subtracted in forcerepay
- 57067 - [SC - Low] overstated per account locked collateral due to global clamp in subdebt
- 57345 - [SC - High] missing cumulativeearmarked decrement in forcerepay breaks earmarking invariant leading to unfair redemption burden distribution
- 58198 - [SC - Low] broken two step admin transfer pattern
- 58578 - [SC - Low] zeroxswapverifier allows attackers to drain strategy tokens via crafted calldata
- 57771 - [SC - Medium] fee not collected in forcerepay when should
- 57534 - [SC - Low] small debt positions cannot be liquidated due to zero amount checks on token vaults
- 56418 - [SC - Low] two step owner transfer is broken and can lead to unforseen damages
- 58087 - [SC - Medium] moonwellusdcstrategy ignores redeemunderlying error codes temporary freezing of funds withdrawals revert
- 58004 - [SC - High] protocol insolvency from cumulativeearmarked during forcerepay
- 58236 - [SC - High] accounting mismatch forcerepay doliquidation fail to decrement mytsharesdeposited locking deposit capacity and overstating collateral
- 58289 - [SC - Low] missing addresses verification in zeroxswapverifier
- 58739 - [SC - Insight] decimals mismatch causes 1e12 under reporting in strategy returns letting allocations silently exceed per strategy and global caps
- 57088 - [SC - High] unscaled collateral accounting in redeem lets users withdraw more than intended
- 58324 - [SC - High] incorrect return value in deallocate function leads to permanent fund locking in mytstrategy implementations
- 58051 - [SC - Low] incorrect access control in acceptadminownership
- 58394 - [SC - High] mev opportunity because no slippage protection in tokeautoethstrategy
- 56949 - [SC - Insight] uncapped collateral transfer in redemption leads to accounting discrepancy enabling theft of user funds
- 57787 - [SC - High] asset can be transferred to strategies even when the killswitch enabled without posibility to use this funds for allocation
- 58519 - [SC - High] double counting of collateral due to mytsharesdeposited not being updated during liquidations
- 57079 - [SC - Low] h 1 morphoyearnogweth strategy incorrect balance measurement order in deallocate causes dos on withdrawals with any loss
- 58702 - [SC - High] no slippage provided in auto strategy implementation will open room for mev attacks
- 58347 - [SC - High] accounting drift due to missing mytsharesdeposited decrements during liquidation
- 58769 - [SC - High] forcerepay fails to decrement global cumulativeearmarked causing redemption accounting desynchronization and potential protocol wide redemption halt
- 58796 - [SC - Low] incorrect balance snapshot in deallocate causes wethredeemed always 0
- 58714 - [SC - Low] pending admin cannot accept ownership in alchemistcurator sol
- 58575 - [SC - Low] operator limit bypass
- 56324 - [SC - Low] missing from owner check in transferfrom verifier direct theft of user funds
- 57680 - [SC - High] peapodsethstrategy unable to withdraw yield from price share increase
- 57167 - [SC - Medium] missing claim function in euler and morpho strategies leads to loss of yield rewards
- 58002 - [SC - Low] missing submitremovestrategy function
- 56346 - [SC - Insight] redundant calculation of feeamount in repay function
- 57749 - [SC - Low] zeroxswapverifier misses critical sender recipient minout validations allowing malicious 0x calldata to drain funds critical direct theft
- 56776 - [SC - High] tvl manipulation via missing mytsharesdeposited decrement in liquidations
- 57023 - [SC - High] global earmark not reduced in forcerepay lets redeem over burn global debt cross account leakage protocol insolvency
- 57950 - [SC - High] unit mismatch in adddebt collateralization check allows unbacked debt issuance and protocol insolvency
- 58270 - [SC - Critical] incorrect handling of debt cover in redeem can affect early liquidation and incorrectly sync accounts
- 58398 - [SC - High] no slippage protection on large allocation deposits
- 58413 - [SC - Critical] attacker user can prevent earmark from updating the earnmarkweight causing the transmuter action to repay det gradually to fail for all users
- 57288 - [SC - High] flawed rounding logic in tokeautoeth deallocate function causes permanent freezing of funds
- 57704 - [SC - High] missing global state update in forcerepay leads to permanent freezing of unclaimed yield
- 56555 - [SC - Critical] user can avoid bad debt ratio scaling when claiming redeem leading to protocol insolvency
- 58442 - [SC - High] liquidation breaks core accounting invariant missing cumulativeearmarked update in forcerepay causes permanent state drift
- 56800 - [SC - Medium] Minimum collateral change lets liquidators seize compliant accounts
- 58515 - [SC - Medium] a liquidated position can end the liquidation process still below collateralizationlowerbound allowing for double liquidation of positions
- 56571 - [SC - High] inflated claim payouts from double counted myt after liquidation
- 58757 - [SC - Critical] forgotten cover in earmark causes systematic over earmarking and temporary freezing of user collateral
- 58143 - [SC - Low] unused cap enforcement variables adjusted
- 57866 - [SC - Low] failure to verify the recipient s address can result in the theft of purchased tokens
- 58781 - [SC - High] totallocked accounting mismatch leading to token balance deficit in alchemistv3
- 58352 - [SC - Low] assets become permanently stuck in tokeautoeth strategy due to strict balance check
- 58547 - [SC - High] mismatched accounting and transfer for capped fees
- 57272 - [SC - Medium] silent failures on moonwell deposit are not catched by strategy
- 58423 - [SC - Low] pending admin cannot accept ownership transfer in alchemistcurator
- 57632 - [SC - High] inflated tvl in mytsharesdeposited hides protocol insolvency
- 56911 - [SC - Low] incorrectly implemented two step admin ownership transfer mechanism prevents new admin to accept role
- 57730 - [SC - High] liquidation does not decrease mytsharesdeposited
- 56678 - [SC - High] missing internal myt shares accounting in liquidation functions causes deposit blocking and protocol insolvency risk through inflated tvl calculations
- 57448 - [SC - Insight] unnecessary computation of lockedcollateral in adddebt and subdebt
- 57973 - [SC - Critical] repay doesnt set lasttransmutertokenbalance leading to the same balance covering earmark twice
- 57514 - [SC - Low] calldata verification bypass in 0x preflight logic enables arbitrary from recipient manipulation and direct fund theft
- 57637 - [SC - Low] acceptadminownership doesn t allow expected user approval
- 56719 - [SC - High] the function forcerepay reduces debt before clamp creating unbacked loan forgiveness and protocol insolvency
- 58419 - [SC - Low] alchemistcurator two step ownership transfer mis implemented
- 58120 - [SC - Low] incorrect balance measurement in morphoyearnogweth strategy leads to incorrect deallocation loss registering
- 56791 - [SC - High] missing mytsharesdeposited decrements in token transfers
- 56689 - [SC - Low] reward token toke is stuck in myt
- 56839 - [SC - Medium] moonwell strategies fail to check compound error codes causing silent allocation failures
- 58542 - [SC - Low] [Low] Logic Error in MorphoYearnOGWETHStrategy._deallocate(): wethRedeemed Always Zero → All Deallocations Emit StrategyDeallocationLoss
- 56348 - [SC - Insight] incorrect apy calculation in mytstrategy approxapy causes underreported yields
- 58667 - [SC - Insight] permit2 is approved the wrong asset which leads to loss of funds or failing swaps
- 56350 - [SC - Insight] implementation contract alchemistv3 not locked disableinitializers missing
- 57622 - [SC - Low] lack of claimed reward handling in myt strategies will keep all external token rewards stuck forever
- 56730 - [SC - Insight] transmuter tokenuri is not eip 721 compliance
- 58273 - [SC - Medium] incorrect hardcoded 0x settler function selectors
- 57849 - [SC - High] funds gets stuck even when killswitch is enabled
- 57169 - [SC - Low] zeroxswapverifier policy bypass via rfq filldata prefix token amount spoof
- 57093 - [SC - Critical] potential locked funds due to partial redeem shortfall and miss calculation lead to user loss their myt token forever
- 58703 - [SC - Insight] cached interest rate calculation in peapodseth strategy leads to inaccurate apr apy estimates
- 57621 - [SC - Low] improper reward claiming in tokeautoethstrategy sends toke tokens to wrong address causing permanent freezing of unclaimed yield
- 58207 - [SC - High] AlchemistV3 _mytSharesDeposited Not Reduced When Repaid Collateral Sent to Transmuter
- 57511 - [SC - Medium] protocol could atleast be taking a part of the protocol fee
- 57582 - [SC - Critical] calling earmark one block apart skips the block s earmark value
- 58076 - [SC - Insight] Fix unit mismatch in _doLiquidation: collateralInUnderlying -> collateralInDebt
- 58209 - [SC - Medium] lack of slippage protection in transmuter claimredemption and alchemistv3 withdraw leads to user yield losses
- 56751 - [SC - Medium] stargateethpoolstrategy deallocate function redeem less weth than expected
- 58146 - [SC - Insight] Whitelist can be disabled repeatedly, contradicting intended program behavior.
- 58452 - [SC - High] mytstrategy allocation underflow in deallocate when allocation profits exceed old allocation
- 56859 - [SC - Medium] lp underlying mismatch in stargateethpoolstrategy deallocate causes withdrawal dos
- 56809 - [SC - High] vulnerable redemption survival ratio in sync allows theft of altokens
- 57328 - [SC - Low] once tokelockduration is the opposite of zero in tokeautoethstrategy accumulated rewards in acctoke can be stuck
- 56732 - [SC - Critical] incorrect boundary condition in querygraph leads to systematic under earmarking and transmuter redemption fund loss
- 56961 - [SC - Low] incorrect balance snapshot check in deallocate logs false deallocation loss in morphoyearnogweth strategy
- 57791 - [SC - Insight] receipt token misconfiguration in aave strategies
- 57692 - [SC - High] alchemistv3 liquidation fee loss vulnerability
- 56462 - [SC - Insight] unused mapping causes unnecessary storage gas consumption
- 57122 - [SC - Critical] mismatch between capped fee and returned fee in resolverepaymentfee
- 58474 - [SC - High] liquidator will bypass liquidation fees affecting protocol revenue
- 56965 - [SC - Critical] alchemistv3 handling of added transmuter coverage includes an error that enables an attacker to cause protocol insolvency
- 58274 - [SC - High] liquidation fee logic in doliquidation strands liquidator rewards when balance is exhausted freezing funds
- 58734 - [SC - Low] broken strategy realassets calculation
- 58522 - [SC - High] earmark consumes excess cover inflating cumulativeearmarked
- 57770 - [SC - Medium] admin can bypass permissionedcalls protection using multicall
- 57982 - [SC - Low] permanently stuck rewards in the vault
- 58358 - [SC - High] mismatched collateralweight and rawlocked causes incorrect collateral removal in sync
- 56737 - [SC - Medium] the return value of mint is not checked
- 58131 - [SC - Critical] rounding errors in debt to collateral conversions allow attackers to drain protocol assets
- 58400 - [SC - Low] alchemist allocator does not actually enforce caps
- 58792 - [SC - High] the cumulativeearmark does not decrease in forcerepay which lead to transfer more collateral from users even when all earmark debt cleared which breaks the alchemix v3 core logic
- 57212 - [SC - High] totallocked is not properly decremented in the redeem function causing system insolvency
- 57793 - [SC - High] cumulativeearmarked variable is not updated in forcerepay function breaking core internal logic and leading to user funds being stuck
- 57114 - [SC - Low] inherited setadmin function allows to bypass two step admin ownership transfer mechanism
- 58450 - [SC - High] missing transmuter balance update after redemption blocks future earmarking and underfunds redemptions
- 56757 - [SC - High] incorrect leftover collateral check blocks liquidator fee payment leading broken incentives delayed deleveraging
- 58719 - [SC - Insight] insight gas optimization save gas by using the cached fee amount in burn and repay in alchemist sol
- 58356 - [SC - Insight] the alchemist tokeauto strategies doesn t use recommended best practice by tokeauto
- 56491 - [SC - Critical] user collateral loss triggered by setminimumcollateralization update
- 58628 - [SC - High] attackers can avoid redemption losses by temporarily burning and re borrowing the debt
- 58626 - [SC - Critical] repayment fee overpayment in liquidation repay only path
- 56336 - [SC - Insight] stargateethpoolstrategy deallocate would emit false deallocating loss event in some cases
- 58133 - [SC - Low] toke rewards permanently locked in strategy adapter
- 58129 - [SC - High] missing mytsharesdeposited update in forcerepay causes accounting inconsistency which can dos deposit and liquidation
- 56328 - [SC - Insight] redundant require statement in eulerusdcstrategy deallocate function leads to unnecessary gas consumption
- 57633 - [SC - High] block gated earmark call in redeem nullifies prefunded transmuter cover on the first redemption of each block leading to collateral overpayment and potential protocol insolvency
- 57585 - [SC - High] alchemistv3 does not properly update cdp collateralbalance when redemptions exceed totallocked which enables some cdps to over withdraw collateral on account of others
- 57460 - [SC - High] protocol fails to subtract fee from total locked when burning and repaying
- 58555 - [SC - Low] alchemistcurator 2 step ownership transfer is implemented incorrectly
- 58086 - [SC - High] mis accounting of myt outflows inflates tvl distorts collateralization and can dos deposits liquidations
- 58590 - [SC - Low] incorrect balance read ordering in morphoyearnogwethstrategy deallocate
- 57189 - [SC - High] alchemistcurator contract not implement setforcedeallocatepenalty
- 56395 - [SC - High] accounting desync in liquidation outflows leads to artificial deposit cap exhaustion and denial of service on recapitalization
- 58203 - [SC - Medium] moonwell strategies silent failure due to unchecked mint and redeemunderlying return values
- 56846 - [SC - Medium] liquidation will return because of insufficient funds
- 57335 - [SC - Medium] zero min out erc 4626 deposits cause under mint and permanent allocation loss
- 58105 - [SC - Medium] zeroxswapverifier decodes execute payload with wrong abi bytes vs bytes temporary freezing of funds
- 58491 - [SC - High] mytsharesdeposited not reduced on liquidation leading to deposit cap bypass and potential insovency
- 58210 - [SC - Low] incorrect balance measurement in deallocation disables loss detection in morphoyearnogweth
- 57546 - [SC - Low] moonwellusdcstrategy fail to claim its reward from moonwell comptroller
- 57751 - [SC - High] there is a problem related to forced liquidation branch and this creates issue thatk cna drains protocol backing
- 57941 - [SC - High] incorrect handling of deallocate return val causes any interest gains in a strategy to become unclaimable and permanently locked
- 56806 - [SC - Insight] broken withdrawal logic in aavev3arbwethstrategy permanently locks user funds
- 58572 - [SC - High] liquidation of account collateral doesn t subtract mytsharesdeposited which creates bad debt in the system and causes insolvency
- 58078 - [SC - Low] access control bypass in zeroxswapverifier missing owner validation
- 58403 - [SC - Medium] missing checks for transaction return values in moonwell strategies
- 57439 - [SC - Low] incorrect baddebtratio rounding in transmuter claimredemption may cause funds to become permanently stuck
- 57123 - [SC - Low] incorrect 2 step ownership in alchemistcurator
- 56365 - [SC - Critical] liquidation fee overdraft drains pooled collateral
- 58488 - [SC - Low] tokeautousdstrategy claims rewards to itself automatically when deallocate is called but since reward token is tokemak the rewards remain permanently locked
- 58019 - [SC - High] flawed killswitch implementation in mytstrategy leads to permanent loss of funds
- 56975 - [SC - High] liquidation fee trapping in alchemistv3
- 58507 - [SC - Critical] repayment fee after forcerepay could result in socialized loss during global undercollateralization
- 56882 - [SC - Low] missing cap enforcement in alchemistallocator allows operators to bypass risk controls
- 57788 - [SC - Medium] Missing _claimRewards() Implementation in AaveV3ARBUSDCStrategy Leads to Permanent Loss of Aave Incentive Rewards
- 56909 - [SC - Low] incorrect balance snapshot in strategy deallocation causes false loss events and masks real shortfalls
- 57563 - [SC - Insight] reward tokens being permanently frozen in tokeautousdstrategy
- 57036 - [SC - High] unconditional debt reduction before protocol fee check in force repayment
- 58115 - [SC - Medium] incorrect weth deposit amount prevents deposited eth through receive function to cover strategy loss
- 56873 - [SC - Medium] incorrect eth wrapping condition in moonwellwethstrategy deallocate leads to temporary freezing of funds
- 56602 - [SC - Low] function takes incorrect modifier
- 56628 - [SC - High] liquidate does not update mytsharesdeposited that is reduced by fees
- 58552 - [SC - Insight] single transfer instead of multiple saves gas
- 57954 - [SC - High] lackf of tracking of excess cover in earmark function leads to permanent loss of cover value and stuck user positions
- 58313 - [SC - Medium] incorrect allocation accounting and dust handling in stargateethpoolstrategy causes systematic loss cap mis accounting and deallocation reverts
- 57476 - [SC - High] forcerepay fails to decrement global cumulativeearmarked
- 57907 - [SC - High] incorrect forced repayment accounting allows debt forgiveness and frees locked collateral systemic loss
- 58787 - [SC - Medium] when allocation amount is greater than the maxdeposit of tokeautoeth sol the remaining is stuck in tokeautoeth sol
- 58006 - [SC - Medium] MoonwellUSDCStrategy._allocate ignores Compound-style mint failures and corrupts vault accounting
- 58709 - [SC - Low] naive 0x fill parsing lets attackers spoof token and amount checks
- 58387 - [SC - High] liquidator fee in the doliquidation function withheld when collateral is exhausted leading to seized fee trapped in protocol
- 56817 - [SC - High] forcerepay doesn t decrement mytsharesdeposited inflating tvl
- 58185 - [SC - Medium] incorrect survivalaccumulator accounting logic after earmarkweight reaches 128 breaks core system invariants and can lead to protocol insolvency
- 56878 - [SC - Medium] the permissionedcalls check can be bypass
- 58472 - [SC - High] liquidator base fee seized but not paid due to post deduction balance check
- 58408 - [SC - Low] underflow account rawlocked on subdebt due to rounding inconsistency
- 58354 - [SC - High] forcerepay does not decrement mytsharesdeposited causing a temporal blocking of new deposits
- 58320 - [SC - Critical] incorrect fee return value in resolverepaymentfee enables fund theft under extreme conditions
- 57316 - [SC - Low] Allocation Cap Enforcement Missing & DeadCode
- 58743 - [SC - Low] zeroxswapverifier recipient validation bypass
- 58323 - [SC - Critical] the alchemist burn function experiences precision loss resulting in the avoidance of protocol fees
- 58666 - [SC - Low] recipient owner not enforced in action verifiers enables theft of swap proceeds
- 56572 - [SC - Insight] aave v3 lending pool is immutable in aave strategies
- 56625 - [SC - Low] broken ownership transfer logic in alchemistcurator permanently freezes contract operations
- 57995 - [SC - High] missing slippage protection in tokeautousdstrategy allocation function leads to permanent value loss
- 57746 - [SC - Low] broken contract ownership logic at alchemistv3 sol
- 57760 - [SC - High] mytstrategy allocate deallocate doesnt account for profit and loss
- 57227 - [SC - Medium] unchecked return codes in moonwellusdcstrategy leading to stuck funds
- 57964 - [SC - Low] improper validation of absolutecap and relativecap enables excessive fund allocation in alchemistallocator
- 58730 - [SC - Medium] an attacker can prevent any tokenauto strategy allocation by making a donation to the vault of as little as 1 wei of underlying token
- 57752 - [SC - Medium] aave and euler incentives for myt will be lost due to unimplemented claimrewards function
- 57983 - [SC - Low] direct asset drain via zeroxswapverifier bypass and mytstrategy unlimited permit2 approvals
- 56827 - [SC - High] missing global earmark reduction in forcerepay
- 56714 - [SC - High] accounting invariant violation in forcerepay leads to protocol insolvency
- 57989 - [SC - Low] broken isvalidsignature leads to fund freezing
- 58782 - [SC - High] rewards earned by eulerarbusdcstrategy will not be withdrawable from euler pool on arbitrum
- 56383 - [SC - Low] the alchemistcurator acceptadminownership can t be called by the pending admin and if the function is called without pending admin the admin rigths will be lost
- 57066 - [SC - Critical] a malicious actor can keep calling poke at every block to prevent collateral earmarking exposing transmuter users to delayed redemptions and loss of funds
- 58275 - [SC - High] account rawlocked not clear even when debt is clear
- 58480 - [SC - Low] Missing recipient and token binding in verifySwapCalldata leads to unauthorized fund transfers
- 57330 - [SC - Critical] resolverepaymentfee returns initial fee when fee is greater collateral balance
- 57740 - [SC - High] eulereth strategy will have weth locked in the strategy contract
- 58771 - [SC - High] incorrect tracking of total deposited yield tokens mytsharesdeposited in liquidation and force repayment paths
- 58334 - [SC - Medium] incorrect function selectors
- 56960 - [SC - Medium] missing slippage protection during redemption execution lead to loss of token for user
- 58512 - [SC - Low] mytstrategy isvalidsignature is implemented wrong and will not work
- 58531 - [SC - Critical] querygraph function zero return bug causing tracking earmarking failure over progressive block intervals
- 57394 - [SC - Low] acceptAdminOwnership() only allows the current admin to finalise transfers
- 58497 - [SC - Low] the amount of weth redeemed is not calculated properly in morphoyearnogweth
- 56517 - [SC - Low] zeroxswapverifier validates struct but executes external actions enabling direct fund theft
- 56406 - [SC - Insight] getestimatedyield never updates after snapshots
- 58456 - [SC - Medium] account can enter unliquidatable state with residual debt
- 57861 - [SC - High] missing slippage protection in tokemak autopool allocation functions leads to direct theft of user funds
- 57916 - [SC - Critical] repay removes earmark meant to be reducing debt while collateral is still reduced
- 58648 - [SC - Low] incorrect wethbalancebefore read causes broken loss detection in deallocation
- 57127 - [SC - Low] pending admin should call the function instead of admin
- 58418 - [SC - Low] verifyswapcalldata cant verify the output token of the swap
- 56830 - [SC - Low] broken admin ownership transfer logic acceptadminownership requires current admin instead of pending admin blocking role claim
- 58125 - [SC - Critical] repayment fee overpayment from pooled collateral
- 57970 - [SC - High] forcerepay leaves cumulativeearmarked stale
- 58249 - [SC - Low] broken two step admin handover in alchemistcurator
- 57101 - [SC - Critical] same block earmark early exit leaves stale transmuter balance causing under earmarking
- 58516 - [SC - Low] inverted min max logic in alchemistallocator operator cap calculation
- 56389 - [SC - High] mytsharesdeposited is not updated on liquidation outflows which could lead to solvency illusion and misreported global ratios
- 58688 - [SC - Critical] alchemistv3 liquidate can steal other users collateral
- 57777 - [SC - Low] zerox swap verifier bypass enables direct theft of user funds
- 56798 - [SC - Critical] flash vote exploit drains all funds via alchemistallocator
- 58231 - [SC - Medium] attacker can stop protocol from allocating assets to the autoeth vaults
- 57148 - [SC - High] mytsharesdeposited variable is not correctly updated during liquidations leading to wrong assumptions and incorrect bad debt calculation in the transmuter
- 58736 - [SC - High] missing tvl accounting in forcerepay and doliquidation leads to protocol insolvency
- 57678 - [SC - High] liquidation fee is deducted from user but not paid to liquidator
- 58658 - [SC - High] cumulativeearmarked not updated
- 58094 - [SC - Insight] autopooleth vault slippage during lp token liquidation leads to temporary fund freezing
- 58527 - [SC - Low] complete loss of all reward value on tokeautoethstrategy claimrewards
- 58376 - [SC - Low] claimrewards function permanently locks earned toke reward token on morpho vaultv2
- 57606 - [SC - Insight] attacker can dos deposits by hitting the deposit cap
- 56845 - [SC - High] the deposit will be reverted because mytsharesdeposited references an outdated value
- 56658 - [SC - Insight] transmuter s tokenuri does not revert for nonexistent tokenids
- 56887 - [SC - Low] incorrect balance tracking in morphoyearnogwethstrategy deallocate function leads to wrong loss event emission resend
- 57972 - [SC - High] liquidation doesn t update mytsharesdeposited
- 56740 - [SC - Critical] unbounded liquidation fee allows theft of shared collateral
- 58287 - [SC - High] mytsharesdeposited is not updated on some token transfer
- 58579 - [SC - Low] inconsistent admin management implementation in alchemistcurator sol
- 58022 - [SC - Medium] accounting mismatch and fund stuck due to dust eth on stargateethpoolstrategy
- 58723 - [SC - High] cumulativeearmarked is not updated at forcerepay
- 58239 - [SC - Medium] missing aave incentives rewards claiming mechanism leads to permanent loss of protocol royalties
- 58333 - [SC - Low] incorrect onlyadmin modifier in acceptadminownership
- 58520 - [SC - Low] pending admin cannot accept ownership
- 58067 - [SC - High] asymmetric deallocation in tokeautoethstrategy leads to permanent weth funds stuck in strategy
- 58260 - [SC - High] inconsistent collateral accounting where force repay liquidation transfer out myt without adjusting tvl
- 57963 - [SC - High] incorrect mytsharesdeposited accounting in liquidate allows theft of user funds via corrupted bad debt ratio
- 58645 - [SC - Medium] incorrect weth wrapping amount in moonwellwethstrategy deallocate wraps ethredeemed instead of amount
- 58138 - [SC - Critical] liquidator fees could surpass the user remaining collateral resulting in protocol insolvency
- 58544 - [SC - Critical] it is possible to underflow on sync making positions bricked forever
- 57725 - [SC - High] alchemistv liquidate is not updating the mytsharesdeposited which makes it inflated and can cause deposits dos and liquidations malfunction that may cause protocol insolvency
- 58443 - [SC - Critical] incorrect consumption of yield cover in redeem leading to reuse of accrued yield
- 56824 - [SC - High] missing update to mytsharesdeposited during liquidation
- 56962 - [SC - Low] balance check logic error in deallocate function leads to broken loss detection and false event emissions
- 57625 - [SC - Low] incorrect cover accounting in earmark leads to earmarking failure and value leakage
- 58447 - [SC - Critical] unfair collateral loss through socialized redemption costs
- 57196 - [SC - High] artificially inflated mytsharesdeposited in alchemixv3 sol deflates bad debt ratio in transmuter sol
- 56895 - [SC - Insight] function approvemint is vulnerable to race conditions
- 58755 - [SC - High] users position that are synced at certain times overestimate collateralbalance of the position
- 58269 - [SC - High] liquidator fee not paid when fee equals surplus
- 58383 - [SC - High] due to cumulativeearmarked not being updated in alchemix forcerepay user funds are locked longer due to slower debt decay and calculation of system collaterization rate is inc
- 58636 - [SC - Low] broken two step admin transfer prevents legitimate admin succession in alchemistcurator
- 56343 - [SC - Low] morphoyearnogweth deallocate function always emits strategydeallocationloss due to flawed balance measurement
- 56902 - [SC - High] strategy adapter aavev3opusdcstrategy would not work well with atoken rebasing mechanism
- 58215 - [SC - High] funds can become permanently stuck in adapter when kill switch is enabled
- 56672 - [SC - High] inconsistent myt share accounting leads to under liquidation and solvency risk
- 58088 - [SC - Low] inadequate enforcement of global cap enables cumulative over allocation
- 57867 - [SC - Medium] zeroxswapverifier erroneously rejects uniswap v3 swaps due to an an incorrect selector
- 58466 - [SC - High] liquidation fee payment failure due to redundant wrong collateral check
- 56465 - [SC - Low] gettotaldeposited doesn t reflect the correct total deposited
- 57544 - [SC - High] mytsharesdeposited is not reduced upon fee transfers to protocol
- 57311 - [SC - Medium] moonwell allocation and deallocation can fail silently causing incorrect state updates and loss of yield
- 56673 - [SC - High] zero cost fee farming via forced earmarked repayment
- 58369 - [SC - High] missing mytsharesdeposited decrements in forcerepay doliquidation leads to smart contract unable to operate due to lack of token funds
- 56927 - [SC - Medium] setminimumcollateralization function also needs a another check
- 58080 - [SC - Medium] aave v3 strategies fail to claim op arb liquidity mining rewards causing permanent loss of yield
- 56983 - [SC - Low] tokemak rewards sent to myt vault contract not strategy rewards stranded
- 57726 - [SC - High] alchemistv3 myt tvl accounting drift on liquidation forcerepay blocks deposits via depositcap medium smart contract unable to operate due to lack of token funds
- 58741 - [SC - Medium] action function signatures to 0x settler are wrong
- 58422 - [SC - Low] morphoyearn og weth strategy always emits deallocation loss event due to zero delta calculation
- 57208 - [SC - Insight] it is possible to prevent lowering the deposit cap by front running
- 58357 - [SC - Low] permanent freezing of tokeautoeth strategy rewards in myt vault
- 57479 - [SC - Low] logical bug in alchemistcurator acceptadminownership asking to current admin to accept ownership
- 58177 - [SC - High] transmuter claimredemption cant update mytsharesdeposited leading to permanent underlying value state inside alchemist
- 57291 - [SC - Insight] hardcoded slippage in myt strategy
- 56709 - [SC - Low] zeroxswapverifier missing source validation
- 58033 - [SC - Medium] unimplemented claimrewards function results in permanent freezing of aave incentive rewards
- 56855 - [SC - Medium] liquidations fail with arithmetic underflow when forced repayment exhausts collateral
- 58672 - [SC - Low] incorrect balance check sequence
- 58130 - [SC - Medium] asymmetric validation in collateralization setters allows protocol misconfiguration breaking all borrowing
- 57152 - [SC - High] assets permanently locked due to killswitch flag
- 58754 - [SC - High] missing mytsharesdeposited decrements in alchemistv3 forcerepay doliquidation
- 57812 - [SC - Medium] no function to claim aave incentives
- 58564 - [SC - Critical] earmarked funds fail to accumulate when earmark is called in consecutive blocks
- 57183 - [SC - Medium] missing incentive rewards claiming in multiple strategy contracts
- 58518 - [SC - Critical] liquidation will steal repayment fee from innocent users funds
- 58705 - [SC - Low] mismatch between emitted protocol fee and actual fee paid in forcerepay due to strict inequality check
- 58707 - [SC - Medium] moonwell strategy allocate does not revert when mint fails which can result in a sudden drop in myt share price and consequently sever under collateralization
- 58627 - [SC - Low] incorrect delta calculation in deallocate causes wethredeemed to always be zero
- 57024 - [SC - Low] wethbalancebefore is computed after withdrawal in deallocate function in morphoyearnogwethstrategy contract leading to systematic strategydeallocationloss event emission
- 58773 - [SC - Medium] in stargate incorrect allocation cap accounting leading to unnecessary dos
- 58010 - [SC - High] slippage tolerance not enforced in tokeautousdstrategy
- 58266 - [SC - High] partial liquidation strands base fee due to post seizure balance check
- 58101 - [SC - Critical] repayment only liquidation overpays fee from pooled collateral
- 56936 - [SC - High] missing mytsharesdeposited decrements on repay liquidation tvl drift false over collateralization and deposit cap dos
- 58360 - [SC - Low] round down calculation in converttoshares leads to deallocation failure in tokeautoeth strategy
- 56622 - [SC - Critical] repayment fee overpays liquidators using pooled collateral after forcerepay
- 58113 - [SC - High] stargateethpoolstrategy realassets return false real assets
- 58337 - [SC - High] Incorrect Handling of cumulativeEarmarked in _forceRepay leads to inflated survival accumulator.
- 58793 - [SC - Critical] repayment fee overpayment from global collateral pool
- 58464 - [SC - Critical] repayment fee paid from protocol funds when user collateral is depleted
- 58259 - [SC - Low] broken operator logic inside alchemistcurator
- 56923 - [SC - High] missing cumulativeearmarked update in forcerepay causes incorrect debt accounting in alchemistv3
- 58409 - [SC - High] high arithmetic underflow in mytstrategy sol s deallocate check prevents yield withdrawal
- 58435 - [SC - High] systemic accounting bug leads to protocol insolvency
- 58573 - [SC - Critical] alchemistv3 repayment fee cross account theft vulnerability
- 57308 - [SC - High] alchemistv3 does not update mytsharesdeposited when performing liquidation causing global accounting and liquidation logic mismatch
- 57599 - [SC - Low] protocol wrongly withdraws before checking balance of withdraw
- 58492 - [SC - Medium] unbounded deposit exposure in tokeautoethstrategy allocate
- 58449 - [SC - Medium] tokeautoeth strategy balance approval mismatch dos
- 56775 - [SC - Medium] permanent freezing of funds from precision dust strict deallocation check
- 58244 - [SC - Low] incorrect balance check order in morphoyearnogweth strategy leads to false deallocation loss events
- 58604 - [SC - Low] verification bypass in verifyexecutemetatxncalldata enables arbitrary 0x actions to pass checks and execute in the zeroxswapverifier sol contract
- 57369 - [SC - High] deallocation may revert due to an underflow
- 57028 - [SC - Insight] wrong amount variable in repay event
- 57331 - [SC - Medium] Conditional ETH Wrapping Logic Causes Withdrawal DoS in MoonwellWETH and StargateETH Strategies
- 57930 - [SC - High] allocation tracking underflow in strategy deallocation leads to protocol insolvency
- 56498 - [SC - Low] reserve drainage due to incorrect balance measurement
- 58728 - [SC - Medium] when the strategy is at a loss the assets cannot be withdrawn
- 58524 - [SC - High] when liquidating there are cases where the fee is not paid to the liquidator
- 56982 - [SC - Medium] incorrect function selectors used in zeroxswapverifier
- 58325 - [SC - Low] operator can shift vault funds to risky strategies without oversight leading to potential loss of user funds
- 58386 - [SC - Low] rewards claimed during deallocation remain stranded on strategy and unaccounted
- 56832 - [SC - Low] alchemistcurator contract doesn t allow to remove strategies from the myt morpho v2 vault
- 56385 - [SC - Critical] repayment fee can be paid from the pool even when the account has no collateral left
- 58502 - [SC - High] deposit cap denial of service due to stale mytsharesdeposited during liquidation
- 58310 - [SC - Low] strategy fluidarbusdcstrategy cant claim fluid token reward
- 58288 - [SC - Critical] incorrect fee payment logic leads to underpayment
- 56621 - [SC - Insight] broken withdrawal logic in aavev3arbusdcstrategy permanently locks user funds
- 57774 - [SC - Critical] Redemption Earmark Mechanism Can Be Permanently Blocked via Single-Block Earmark Calls
- 56529 - [SC - Low] incorrect token balance calculation in morphoyearnogwethstrategy sol deallocate leads to wrong event emitted every time
- 58396 - [SC - High] total locked is not cleared proportionally to the total debt this forces the collateral weight to become incorrect and new users transmuter redeem repayment will repay more debt fo
- 58428 - [SC - Low] toke reward loss when calling deallocate
- 58056 - [SC - Low] the auto eth and usdc staking rewards will stuck in vault
- 56836 - [SC - Low] ownership transfer failure in alchemistcurator https github com alchemix finance v3 poc blob immunefi audit src alchemistcurator sol prevents future dao governance or recovery
- 56518 - [SC - Insight] claimwithdrawalqueue discards claimed amount
- 56326 - [SC - Insight] variable could be immutable
- 57862 - [SC - Low] incorrect balancebefore reading order in morphoyearnogwethstrategy deallocate function leads to wrong event emission
- 56427 - [SC - Insight] src utils permissionedproxy sol setpermissionedcall incomplete event emission because it doesnt include value argument for signature
- 56794 - [SC - Critical] liquidators can be overpaid due to accounting error
- 58040 - [SC - Low] removestrategy is non functional
- 57053 - [SC - Critical] integer division precision loss in normalizedebttokenstounderlying leads to permanent collateral locking
- 56815 - [SC - High] missing mytsharesdeposited decrements in internal outflows cause tvl inflation deposit dos
- 57587 - [SC - Critical] earmark reduction of transmuterdifference does not always account for the full transmuter balance diff which can cause permanent earmark to accrue in alchemist
- 58112 - [SC - High] a malicious user can avoid getting penalized upon a transmuter redemption by depositing and withdrawing collateral in the alchemist
- 57197 - [SC - High] incorrect totallocked reduction
- 57837 - [SC - Low] moonwellwethstrategy cant claim reward from moonwell comptroller
- 57483 - [SC - Medium] fees could be skipped when there is not enough collateral
- 58079 - [SC - Low] missing from validation in zeroxswapverifier verifyswapcalldata enables direct theft of approved funds
- 56363 - [SC - High] mytsharesdeposited not correctly updated in all cases leading to incorrect protocol collateralization and reduced liquidation incentives
- 57918 - [SC - High] incorrect totallocked collateral accounting in alchemistv3
- 56528 - [SC - Insight] unbounded slippagebps can freeze withdrawals
- 57825 - [SC - High] forced repay cover enables double counted debt reduction in redeem
- 58797 - [SC - Low] the tokeauto strategies implementation does not accurately report the actual assets held by the strategy
- 58642 - [SC - Low] Cap Bypass in AlchemistAllocator.deallocate() Allows Over-Deallocation Beyond Computed Limits
- 58611 - [SC - Medium] double counting of earmarked debt repayments as cover leads to user funds being stuck and protocol insolvency
- 58189 - [SC - Low] two step mechanism to transfer ownership is broken due to incorrect access control
- 58306 - [SC - Critical] repayment fee not adjusted for insufficient collateral
- 58322 - [SC - Low] incorrect emit due to wrong ordering of wethbalancebefore calculation
- 57516 - [SC - Low] arbitrary external call in zeroxswapverifier leads to theft of unclaimed yield
- 57832 - [SC - Insight] cap logic error in alchemistallocator
- 58718 - [SC - Medium] in forcerepay protocol fee collection leads to theft of unclaimed yield
- 57668 - [SC - High] missing collateral tracking update during liquidation leads to inflated total value calculation and delayed under collateralization protection
- 56332 - [SC - Low] pending admin cannot accept ownership
- 58276 - [SC - Critical] uncapped feeinyield in resolverepaymentfee allows for collateral theft from other depositors
- 58362 - [SC - Low] users will lose tokemak rewards earned in tokeautoethstrategy
- 56893 - [SC - Low] pending admin cannot accept ownership in alchemistcurator
- 58689 - [SC - Critical] incorrect deduction logic in alchemistv3 redeem may lead to insufficient contract collateral
- 56801 - [SC - Insight] function burn could be gas optimized
- 57464 - [SC - High] incorrect accounting in stargate strategy causes protocol insolvency and user liquidations
- 57532 - [SC - High] assets are not accounted for when the contract is in killswitch mode
- 58124 - [SC - Low] direct theft of funds via malicious actions in execute call due to incorrect calldata verification
- 57926 - [SC - Low] the conditional strategydeallocationloss event in morphoyearnogwethstrategy deallocate gets logged all the time due a misplacement in variable declaration
- 57969 - [SC - Insight] lack of incentive to liquidate small positions can cause the system to accumulate bad debt
- 57806 - [SC - Low] staking graph argument bounds are incorrectly defined
- 57447 - [SC - High] untracked myt outflows inflate tvl causing liquidation suppression
- 58605 - [SC - Medium] missing claimrewards in aavev3arbusdcstrategy leads to permanent freezing of accrued aave incentives
- 57251 - [SC - Low] curator cannot remove adapter due to timelock requirement
- 58061 - [SC - High] incorrect collateral and fee check in doliquidation allows liquidator to loose fee
- 57816 - [SC - Insight] critical incentive failure in calculateliquidation leads to protocol insolvency risk during global bad debt
- 58280 - [SC - Critical] repayment s fee is charged from other users causing the contract to fail when the myt total balance of a user cannot cover the fee
- 57346 - [SC - Low] alchemistallocator compares incompatible units asset wei vs wad percentage
- 58081 - [SC - Medium] missing check in function alchemistv3 setminimumcollateralization could lead to set minimumcollateralization globalminimumcollateralization
- 58336 - [SC - Medium] additive update to survival accumulator causing overflow
- 58181 - [SC - Medium] a griefer can cause a permanent dos in tokeautoeth tokeautousdcstrategy allocate
- 58399 - [SC - Critical] precision loss in baddebtratio calculation causes overpayment and dos
- 58326 - [SC - Insight] the value of the burned peapods share token may exceed expectations
- 58639 - [SC - Medium] off by one issue in the forcerepay function causes protocol to lose funds in the form of protocol fee
- 58035 - [SC - High] killswitch early return in strategy causes vault to adapter asset leakage mis accounting and deallocation dos
- 56442 - [SC - High] inflated totallocked because vault yield accrual would skew collateralweight calculation
- 57510 - [SC - High] stale locked collateral tracking during price appreciation causes disproportionate redemption losses
- 57745 - [SC - High] syn fails to update the rawlocked valuation leading to a loss of fund for users with rawlock 0 when total lock become 0
- 56582 - [SC - Low] alchemistcurator removestrategy is unable to remove strategies from vaults due to wrong logic implementation
- 58506 - [SC - Low] adjusted cap limits are never enforced
- 56545 - [SC - High] force repayment leaves stale global earmarks freezing transmuter redemptions
- 57852 - [SC - Critical] old borrowers steal from new borrowers after redemptions are claimed
- 57883 - [SC - High] mytsharesdeposited updates in liquidation functions leads to critical tvl inflation
- 57172 - [SC - High] missing mytsharesdeposited decrements in liquidation flows causes accounting divergence
- 58168 - [SC - Medium] safe position liquidation vulnerability in alchemistv3 when minimumcollateralization equals collateralizationlowerbound
- 58149 - [SC - Low] morphoyearnogweth incorrectly reports loss and triggers strategydeallocationloss event
- 58772 - [SC - Critical] resolverepaymentfee overpays liquidators when collateral is gone letting attackers drain myt
- 58799 - [SC - High] forcerepay does not reduce cumulativeearmarked which leads to wrong accounting users debts are incorrectly higher which can cause wrongful liquidations
- 58794 - [SC - High] hardcoded 0 amount as the minsharesout to depositmax function call does not provide slippage protection
- 57441 - [SC - Critical] repay only fee drain in alchemistv3
- 58301 - [SC - Critical] accounting issue in liquidation logic after force repay we charge repayment fee even if collateral balanc cannot account for it
- 58192 - [SC - High] tokeautoeth strategy tokens locked when autopool router enforces maxdeposit cap
- 57522 - [SC - Insight] usecurrent flag ignored in preview functions in moonwell strategies
- 58393 - [SC - Low] wrong order in balance querying instructions in morphoyearnogwethstrategy deallocate function leads to always emit strategydeallocationloss event
- 58363 - [SC - High] accounting corruption in liquidations due to missing global counter update
- 57617 - [SC - Critical] Protocol-paid repayment fee transfer allows draining of protocol MYT (yield)
- 56727 - [SC - High] underlying increase in forced repayments leads to insolvency
- 58513 - [SC - Low] broken access control in alchemistcurator acceptadminownership prevents admin transfer
- 57041 - [SC - High] deallocation accounting mismatch between vault and adapter
- 58346 - [SC - High] forcerepay fails to decrement cumulativeearmarked breaking earmark invariant and skewing redemptions
- 57646 - [SC - Medium] ABI Signature Mismatch in ZeroXSwapVerifier Causes Complete Failure to Verify Legitimate 0x Settler Transactions
- 57526 - [SC - Medium] StargateEthPoolStrategy rounding mismatch freezes VaultV2 allocations
- 58127 - [SC - Critical] users can invoke the poke function whenever the lastearmarkdebtblock is exactly one block behind the current block number which lead to affecting users earmarked debt
- 57533 - [SC - High] inaccurate tvl calculation prevents liquidations leading to protocol insolvency risk
- 58530 - [SC - High] protocol insolvency via stale totallocked zeroed totallocked prevents collateralweight update in redeem leading to missed collateral haircut
- 58606 - [SC - High] Missing collateral accounting in liquidation leads to inflated bad debt calculations
- 57545 - [SC - Medium] stargate eth strategy rounding bug
- 56402 - [SC - High] killswitch leaves vault assets stranded and blocks withdrawals
- 58196 - [SC - High] aavev3arbusdcstrategy strategy will have its reward stuck in aave usdc
- 57559 - [SC - High] missing mytsharesdeposited decrement in liquidation paths enables theft of unclaimed yield and protocol insolvency
- 58234 - [SC - Critical] there is a problem related ot repayment fee overpayment can lead to protocol insolvency
- 58070 - [SC - High] forced repay accounting lets borrowers erase debt without paying equivalent assets protocol deficit insolvency
- 56702 - [SC - Critical] claimredemption would not return all alasset that is not get converted to myt in some case
- 58425 - [SC - High] missing slippage protection when depositing to tokeauto strategies
- 57553 - [SC - High] mytsharesdeposited is not updated in liquidations which breaks bad debt ratio alchemistcr calculations and causes failures in bad debt handling and liquidation handling
- 58416 - [SC - Low] unclaimed extra rewards in tokemak integration lead to permanent freezing of yield