Immunefi Audit CompetitionsBelong
Reports by Severity
Critical
- 57924 - [SC - Critical] the staking contract is suceptible to the classic first depositor exploit
- 57942 - [SC - Critical] transferred slong shares are permanently unredeemable due to missing stake entry creation
- 56872 - [SC - Critical] freezing of funds
- 57736 - [SC - Critical] first depositor attack is possible
- 57685 - [SC - Critical] vulnerabilities in the design of the token s staking mechanism resulted in financial harm to users involved in transfer related operations
- 57401 - [SC - Critical] erc4626 inflation attack vulnerability
- 57932 - [SC - Critical] attacker can bypass stake lock
- 57008 - [SC - Critical] emergencywithdraw function malfunction due to missing validation in removeanysharesfor
- 56863 - [SC - Critical] first depositor advantage
- 56896 - [SC - Critical] staking contract is vulnerable to inflation attack making malicious 1st staker grief the following stakers
- 57716 - [SC - Critical] erc4626 inflation bug in staking contract
- 57482 - [SC - Critical] front running a donation can inflate the share causing users to lose funds
- 57398 - [SC - Critical] incorrect platform subsidy processing in long payments causing venue payout failures
- 56907 - [SC - Critical] attacker can steal first depositor s asset with inflation attack
- 56850 - [SC - Critical] donation attack posible on staking sol because its totalasset uses asset balanceof
- 57399 - [SC - Critical] erc4626 staking lockbook breaks share fungibility partial transfers can dos withdrawals
- 57813 - [SC - Critical] transfer recipients will pay unwarranted emergency withdrawal penalties for share positions they legitimately own
- 57809 - [SC - Critical] inflation of shares in staking contract
- 57628 - [SC - Critical] improper transfer can lead to funds been frozen
- 56941 - [SC - Critical] staking vault vulnerable to first depositor donation attack
- 57635 - [SC - Critical] erc4626 share transfers desynchronize time lock ledger blocking standard withdrawals for recipients
- 57298 - [SC - Critical] state sync omission in staking transfers forces transferred slong holders into penalized emergency exits
- 57039 - [SC - Critical] processing fee logic flaw in paytovenue causes permanent loss of platform revenue
High
- 57076 - [SC - High] incorrect slippage would result in swap manipulations
- 57786 - [SC - High] malicious users can frontrun staking distributerewards to claim majority of rewards
- 57237 - [SC - High] cross token math contaminates payouts in receiver
- 56881 - [SC - High] temporary claim freezing
- 57733 - [SC - High] swapexact s slippge is not works as expected
- 57515 - [SC - High] cross token accounting is broken
- 56841 - [SC - High] sudden addition of rewards will be frontrun with deposits just to steal part of reward
- 57586 - [SC - High] calculating slippage for swap onchain does not prevent slippage loss
- 57435 - [SC - High] missing slippage protection enables direct theft via mev sandwich attacks
- 57452 - [SC - High] on chain quoter reliance and spot price based swaps enable pool manipulation and value extraction from protocol controlled conversions usdc long
- 57676 - [SC - High] cross token accounting in receiver allows permanent freezing of erc20 royalty payouts
- 57671 - [SC - High] royaltiesreceiverv2 shares referralshare uses dynamic values which may result in failure to release funds properly
- 57829 - [SC - High] incorrect fee implementation in paytovenue long payment path causes protocol fees to be permanently locked in escrow
- 57877 - [SC - High] accesstoken creators can bypass fees so that platform address will receive 0 fees
- 57221 - [SC - High] incorrect processing fee calculation causes venue payouts to be misallocated
- 57061 - [SC - High] retroactive share recalculation causes royalty distribution failure
- 57898 - [SC - High] unprotected swap function allows sandwich attacks
- 57888 - [SC - High] referral tier upgrades freeze legacy royalties
- 57885 - [SC - High] dynamic share drift in royaltiesreceiverv2
- 57290 - [SC - High] mev sandwich attack vulnerability no user controlled slippage protection in token swaps
- 57296 - [SC - High] retroactive referral tier underpayment in royaltiesreceiverv2 due to dynamic shares applied to historical funds
Medium
- 57437 - [SC - Medium] front running in factory produce
- 57634 - [SC - Medium] unauthorized minting of nfts due to signature replay
- 56826 - [SC - Medium] attacker can bloat a victim s stakes array and cause withdrawals emergency flows to run out of gas
- 57610 - [SC - Medium] venues can steal from customers by replaying payments via belongcheckin paytovenue
- 57691 - [SC - Medium] malicious referrer can permanently block eth payment flow
- 57727 - [SC - Medium] venues with autostake long paymenttype can be griefed and cause permanent freeze of long token
- 57615 - [SC - Medium] permanent freezing of user assets in staking sol
- 57905 - [SC - Medium] signature malleability and replay attack vulnerabilities in signature verification
- 57927 - [SC - Medium] front run takeover in factory produce
- 57427 - [SC - Medium] mint signatures are not bound to a collection which makes cross collection replay possible under a shared signer
- 57850 - [SC - Medium] by transferring his staking shares to another non staking address allowing him to bypass minstakeperiod
- 57445 - [SC - Medium] signature replay with mutable parameters
- 57458 - [SC - Medium] dos griefing in batch eth payout malicious payee receive can revert and block releaseall for all payees in royaltiesreceiverv2
- 57790 - [SC - Medium] withdrawal denial of service via dust stake spam
- 57702 - [SC - Medium] the long payment path is sensitive to the long inventory in escrow and insufficient inventory can easily lead to business unavailability dos of long payments
- 57938 - [SC - Medium] produce function doesn t check if creator is the caller allowing frontrunning attacks
- 57194 - [SC - Medium] signature replay across collections missing contract binding
- 57362 - [SC - Medium] attacker can dos user withdraw in staking contract
- 57895 - [SC - Medium] lack of msg sender validation in collection creation signature enables front running attack leading to creator impersonation
- 57388 - [SC - Medium] cross contract signature replay because verifying contract is not included in the digest
- 57911 - [SC - Medium] signature are malleable in signatureverifier sol
- 57917 - [SC - Medium] penallty can be bypassed in staking sol emergencywithdraw
- 57089 - [SC - Medium] unauthorized collection hijack via unsigned creator
- 57677 - [SC - Medium] signature replay in venuedeposit enables affiliate referral code hijacking leading to unauthorized commission theft
- 57245 - [SC - Medium] needless iterations in for loops should be removed for better optimization and code maintenance
- 57875 - [SC - Medium] signature bypass lets creators alter key accesstoken parameters before deployment
- 56814 - [SC - Medium] users can create unauthorized accesstoken collections by exploiting abi encodepacked collision
- 56869 - [SC - Medium] hijacking deployment of accesstoken and stealing ownership to prevent further deployments
- 57864 - [SC - Medium] abi encodepacked hash collision vulnerability in dynamic type encoding permits malicious signature bypass enabling unauthorized and repeatable transaction execution
- 57373 - [SC - Medium] signature replay vulnerability due to missing nonce and deadline checks
- 57854 - [SC - Medium] front running attack allows collection ownership theft
- 57580 - [SC - Medium] signature replay enables frontrunning of produce producecredittoken
- 57279 - [SC - Medium] signature replayability repeated use of signed access tokens allows duplicate mints high
- 57939 - [SC - Medium] signature collision via abi encodepacked
- 57848 - [SC - Medium] permanent freezing of funds due to no minimum stake limit
- 57766 - [SC - Medium] attacker can permanently lock any user s funds
- 57891 - [SC - Medium] signature replay lets attackers hijack nft collection deployment
- 57358 - [SC - Medium] unlimited stake entries allow account griefing via tiny deposits
- 57717 - [SC - Medium] attacker can spam tiny stakes to a victim and make their withdrawal run out of gas griefing dos
- 57283 - [SC - Medium] unauthorised promoter payouts due to signature replay attack
- 56867 - [SC - Medium] signature collision caused counterfeit accesstoken collections with arbitrary name symbol uri
- 57236 - [SC - Medium] accesstoken collection front running attack permanent ownership hijack
- 57669 - [SC - Medium] stakers will bypass minstakeperiod time locks and extract rewards without commitment through emergency withdrawal mechanism
- 57485 - [SC - Medium] emergencywithdraw cost more penalty than expected
- 57271 - [SC - Medium] incorrect penalty calculation on emergency withdrawals redemption s
- 57314 - [SC - Medium] signature replay and hash collision via abi encodepacked in signatureverifier sol
- 57712 - [SC - Medium] receiver deployment dos via salt reuse
- 57426 - [SC - Medium] dynamic price signature replay allows unlimited minting at historical prices
- 57940 - [SC - Medium] deterministic address collision in cairo deployment causes dos and unintended receiver sharing
- 57203 - [SC - Medium] revised malicious accesstoken creator can steal gas via mintstaticprice or mintdynamicprice
- 56810 - [SC - Medium] accesstoken cross contract signature replay allows unauthorized minting on other collections
- 57519 - [SC - Medium] unbounded stake array allows permanent withdraw lock via dust deposits on behalf of victims
- 56860 - [SC - Medium] hash collision in signature verification
- 57800 - [SC - Medium] signature replay vulnerability in belongcheckin distributepromoterpayments
- 57796 - [SC - Medium] signature hashing collision in signatureverifier lets attacker deploy forged accesstoken credittoken metadata critical unintended alteration of what the nft represents
- 57015 - [SC - Medium] unbounded array loop
- 57775 - [SC - Medium] paytovenue will revert due to notenoughlongs funds in the escrow contract
- 57738 - [SC - Medium] name squatting front run on produce allows attacker to preempt legitimate creator and capture future mint revenue
- 57724 - [SC - Medium] universal signature for produce allows front running and collection hijack
- 57723 - [SC - Medium] signature replay front run and timing control issues
- 57929 - [SC - Medium] produce function doesn t check if creator is the caller allowing frontrunning attacks
- 57284 - [SC - Medium] updating minimum staking period griefs previously unlocked users
- 57703 - [SC - Medium] dos with revert via unbounded loop
- 57594 - [SC - Medium] signature collision from abi encodepacked adjacent strings enables unauthorized nft actions mint uri abuse
- 57327 - [SC - Medium] title front running leads to denial of service and unauthorized referral farming in creation functions
- 57310 - [SC - Medium] unaccounted processing fees in long payment path
- 57285 - [SC - Medium] incomplete signature in factory produce enables full accesstoken hijacking and direct fund theft
- 57060 - [SC - Medium] unconditional subsidy withdrawal in paytovenue leads to dos when venue s long pool is depleted
- 57423 - [SC - Medium] unbounded gas consumption in emergency redemption enables low cost dos against staking vault users
Low
- 57453 - [SC - Low] attackers can drain user allowance provided to the belongcheckin sol
- 57255 - [SC - Low] allowed minting of nfts after collection expiry date
- 57650 - [SC - Low] wrapped native token routing can fail without full validation
- 57718 - [SC - Low] staking tier error using erc4626 shares rather than assets to determine staking tiers leads to long term distortion in fees and commissions
- 57558 - [SC - Low] front running issue in emergencycancelpayment
- 57307 - [SC - Low] cairo factory referral percentages never update
- 57425 - [SC - Low] referral percentage updates are ignored due to append only storage in nftfactory
- 57595 - [SC - Low] single tier swap path can stall core flows
- 57583 - [SC - Low] promoter bounty bait and switch via updatevenuerules
- 57505 - [SC - Low] missing collection expiration enforcement allows unauthorized minting
- 57201 - [SC - Low] missing collection expiry enforcement
- 57596 - [SC - Low] reentrancy in distributepromoterpayments allows total theft of promoter and venue funds
- 57872 - [SC - Low] processing fee computed on full long amount instead of subsidy in paytovenue underpaying venues and enabling long payment dos under misconfiguration
- 57884 - [SC - Low] staking tier manipulation via erc4626 shares slong
- 57799 - [SC - Low] retroactive lock period changes affect existing stakes
- 57454 - [SC - Low] referral percentages schedule stuck on first configuration
- 57374 - [SC - Low] staking tier misclassification
Insight
- 57810 - [SC - Insight] gas optimization use calldata for external struct parameters in checkaccesstokeninfo or checkcustomerinfo or checkpromoterpaymentdistribution
- 57921 - [SC - Insight] whitelisted role cannot be revoked in nft cairo
- 57931 - [SC - Insight] consumes more gas than intended in getstandardizedprice function in helper library
- 57803 - [SC - Insight] gas optimize paymentsinfo struct layout to save storage slots and reduce gas costs
- 57134 - [SC - Insight] accesstoken sol is not erc721 compliant
- 57348 - [SC - Insight] incorrectly returned values and emitted data on staking emergency functionality
- 57913 - [SC - Insight] missing validation in setparameters allows invalid fee configuration causing reverts in paytovenue
- 57656 - [SC - Insight] incorrect supply cap check uses token id instead of total supply in base mint
- 57268 - [SC - Insight] erc1155base missing collection uri fallback causes significant gas waste on every token mint
- 57882 - [SC - Insight] venue tokens cannot be withdrawn when there are no promoters involved in customers transactions
- 57467 - [SC - Insight] unlimited referrals hashedcode referralusers increases gas cost with each new referral making it very expensive
- 57874 - [SC - Insight] global metadata wipe on burn one promoter s payout clears the shared erc1155 token uri for all promoters of the same venue
- 57902 - [SC - Insight] erc1155base re mint overwrites token uri allowing post issuance nft alteration griefing
- 57804 - [SC - Insight] unbounded percentages cause underflow and dos in mint payment flow
- 57910 - [SC - Insight] missing validation on referral percentage sum
- 57838 - [SC - Insight] missing produce name sanitization allows breaking snip 12 standard compliance
- 57776 - [SC - Insight] staking sol is not eip4626 compliant breaking integrations
- 57701 - [SC - Insight] accesstoken collectionexpire is never checked allowing tokens to be minted even after the collection expires
- 57735 - [SC - Insight] whitelist bypass in static mint pricing trusting signed params whitelisted instead of on chain iswhitelisted leads to underpricing and access control violation
- 57892 - [SC - Insight] long tokens will be stuck in the escrow if customers exclusively use usdc payments in paytovenue
- 57663 - [SC - Insight] gas storage optimization erc1155info struct in structures sol can save one slot through field reordering
- 57432 - [SC - Insight] royaltiesreceiverv2 fails to distribute full balance when royalties percentages do not sum to 10000
Reports by Type
Smart Contract
- 57810 - [SC - Insight] gas optimization use calldata for external struct parameters in checkaccesstokeninfo or checkcustomerinfo or checkpromoterpaymentdistribution
- 57921 - [SC - Insight] whitelisted role cannot be revoked in nft cairo
- 57931 - [SC - Insight] consumes more gas than intended in getstandardizedprice function in helper library
- 57437 - [SC - Medium] front running in factory produce
- 57924 - [SC - Critical] the staking contract is suceptible to the classic first depositor exploit
- 57453 - [SC - Low] attackers can drain user allowance provided to the belongcheckin sol
- 57803 - [SC - Insight] gas optimize paymentsinfo struct layout to save storage slots and reduce gas costs
- 57634 - [SC - Medium] unauthorized minting of nfts due to signature replay
- 57942 - [SC - Critical] transferred slong shares are permanently unredeemable due to missing stake entry creation
- 56826 - [SC - Medium] attacker can bloat a victim s stakes array and cause withdrawals emergency flows to run out of gas
- 57610 - [SC - Medium] venues can steal from customers by replaying payments via belongcheckin paytovenue
- 57691 - [SC - Medium] malicious referrer can permanently block eth payment flow
- 57727 - [SC - Medium] venues with autostake long paymenttype can be griefed and cause permanent freeze of long token
- 57615 - [SC - Medium] permanent freezing of user assets in staking sol
- 57076 - [SC - High] incorrect slippage would result in swap manipulations
- 57786 - [SC - High] malicious users can frontrun staking distributerewards to claim majority of rewards
- 57905 - [SC - Medium] signature malleability and replay attack vulnerabilities in signature verification
- 57927 - [SC - Medium] front run takeover in factory produce
- 57427 - [SC - Medium] mint signatures are not bound to a collection which makes cross collection replay possible under a shared signer
- 57134 - [SC - Insight] accesstoken sol is not erc721 compliant
- 57850 - [SC - Medium] by transferring his staking shares to another non staking address allowing him to bypass minstakeperiod
- 57445 - [SC - Medium] signature replay with mutable parameters
- 57458 - [SC - Medium] dos griefing in batch eth payout malicious payee receive can revert and block releaseall for all payees in royaltiesreceiverv2
- 57237 - [SC - High] cross token math contaminates payouts in receiver
- 56872 - [SC - Critical] freezing of funds
- 57790 - [SC - Medium] withdrawal denial of service via dust stake spam
- 56881 - [SC - High] temporary claim freezing
- 57702 - [SC - Medium] the long payment path is sensitive to the long inventory in escrow and insufficient inventory can easily lead to business unavailability dos of long payments
- 57736 - [SC - Critical] first depositor attack is possible
- 57733 - [SC - High] swapexact s slippge is not works as expected
- 57938 - [SC - Medium] produce function doesn t check if creator is the caller allowing frontrunning attacks
- 57348 - [SC - Insight] incorrectly returned values and emitted data on staking emergency functionality
- 57194 - [SC - Medium] signature replay across collections missing contract binding
- 57685 - [SC - Critical] vulnerabilities in the design of the token s staking mechanism resulted in financial harm to users involved in transfer related operations
- 57913 - [SC - Insight] missing validation in setparameters allows invalid fee configuration causing reverts in paytovenue
- 57656 - [SC - Insight] incorrect supply cap check uses token id instead of total supply in base mint
- 57515 - [SC - High] cross token accounting is broken
- 56841 - [SC - High] sudden addition of rewards will be frontrun with deposits just to steal part of reward
- 57586 - [SC - High] calculating slippage for swap onchain does not prevent slippage loss
- 57268 - [SC - Insight] erc1155base missing collection uri fallback causes significant gas waste on every token mint
- 57362 - [SC - Medium] attacker can dos user withdraw in staking contract
- 57895 - [SC - Medium] lack of msg sender validation in collection creation signature enables front running attack leading to creator impersonation
- 57255 - [SC - Low] allowed minting of nfts after collection expiry date
- 57650 - [SC - Low] wrapped native token routing can fail without full validation
- 57388 - [SC - Medium] cross contract signature replay because verifying contract is not included in the digest
- 57882 - [SC - Insight] venue tokens cannot be withdrawn when there are no promoters involved in customers transactions
- 57401 - [SC - Critical] erc4626 inflation attack vulnerability
- 57911 - [SC - Medium] signature are malleable in signatureverifier sol
- 57932 - [SC - Critical] attacker can bypass stake lock
- 57435 - [SC - High] missing slippage protection enables direct theft via mev sandwich attacks
- 57718 - [SC - Low] staking tier error using erc4626 shares rather than assets to determine staking tiers leads to long term distortion in fees and commissions
- 57917 - [SC - Medium] penallty can be bypassed in staking sol emergencywithdraw
- 57089 - [SC - Medium] unauthorized collection hijack via unsigned creator
- 57558 - [SC - Low] front running issue in emergencycancelpayment
- 57467 - [SC - Insight] unlimited referrals hashedcode referralusers increases gas cost with each new referral making it very expensive
- 57307 - [SC - Low] cairo factory referral percentages never update
- 57425 - [SC - Low] referral percentage updates are ignored due to append only storage in nftfactory
- 57595 - [SC - Low] single tier swap path can stall core flows
- 57008 - [SC - Critical] emergencywithdraw function malfunction due to missing validation in removeanysharesfor
- 57677 - [SC - Medium] signature replay in venuedeposit enables affiliate referral code hijacking leading to unauthorized commission theft
- 57245 - [SC - Medium] needless iterations in for loops should be removed for better optimization and code maintenance
- 57875 - [SC - Medium] signature bypass lets creators alter key accesstoken parameters before deployment
- 57874 - [SC - Insight] global metadata wipe on burn one promoter s payout clears the shared erc1155 token uri for all promoters of the same venue
- 56814 - [SC - Medium] users can create unauthorized accesstoken collections by exploiting abi encodepacked collision
- 56869 - [SC - Medium] hijacking deployment of accesstoken and stealing ownership to prevent further deployments
- 57864 - [SC - Medium] abi encodepacked hash collision vulnerability in dynamic type encoding permits malicious signature bypass enabling unauthorized and repeatable transaction execution
- 57902 - [SC - Insight] erc1155base re mint overwrites token uri allowing post issuance nft alteration griefing
- 57373 - [SC - Medium] signature replay vulnerability due to missing nonce and deadline checks
- 56863 - [SC - Critical] first depositor advantage
- 57583 - [SC - Low] promoter bounty bait and switch via updatevenuerules
- 57804 - [SC - Insight] unbounded percentages cause underflow and dos in mint payment flow
- 57854 - [SC - Medium] front running attack allows collection ownership theft
- 57910 - [SC - Insight] missing validation on referral percentage sum
- 57838 - [SC - Insight] missing produce name sanitization allows breaking snip 12 standard compliance
- 57776 - [SC - Insight] staking sol is not eip4626 compliant breaking integrations
- 57452 - [SC - High] on chain quoter reliance and spot price based swaps enable pool manipulation and value extraction from protocol controlled conversions usdc long
- 57676 - [SC - High] cross token accounting in receiver allows permanent freezing of erc20 royalty payouts
- 57580 - [SC - Medium] signature replay enables frontrunning of produce producecredittoken
- 57505 - [SC - Low] missing collection expiration enforcement allows unauthorized minting
- 57279 - [SC - Medium] signature replayability repeated use of signed access tokens allows duplicate mints high
- 57939 - [SC - Medium] signature collision via abi encodepacked
- 57671 - [SC - High] royaltiesreceiverv2 shares referralshare uses dynamic values which may result in failure to release funds properly
- 57201 - [SC - Low] missing collection expiry enforcement
- 57596 - [SC - Low] reentrancy in distributepromoterpayments allows total theft of promoter and venue funds
- 57848 - [SC - Medium] permanent freezing of funds due to no minimum stake limit
- 57766 - [SC - Medium] attacker can permanently lock any user s funds
- 57891 - [SC - Medium] signature replay lets attackers hijack nft collection deployment
- 57358 - [SC - Medium] unlimited stake entries allow account griefing via tiny deposits
- 57872 - [SC - Low] processing fee computed on full long amount instead of subsidy in paytovenue underpaying venues and enabling long payment dos under misconfiguration
- 57717 - [SC - Medium] attacker can spam tiny stakes to a victim and make their withdrawal run out of gas griefing dos
- 57283 - [SC - Medium] unauthorised promoter payouts due to signature replay attack
- 56867 - [SC - Medium] signature collision caused counterfeit accesstoken collections with arbitrary name symbol uri
- 57236 - [SC - Medium] accesstoken collection front running attack permanent ownership hijack
- 57884 - [SC - Low] staking tier manipulation via erc4626 shares slong
- 57669 - [SC - Medium] stakers will bypass minstakeperiod time locks and extract rewards without commitment through emergency withdrawal mechanism
- 56896 - [SC - Critical] staking contract is vulnerable to inflation attack making malicious 1st staker grief the following stakers
- 57485 - [SC - Medium] emergencywithdraw cost more penalty than expected
- 57271 - [SC - Medium] incorrect penalty calculation on emergency withdrawals redemption s
- 57716 - [SC - Critical] erc4626 inflation bug in staking contract
- 57314 - [SC - Medium] signature replay and hash collision via abi encodepacked in signatureverifier sol
- 57712 - [SC - Medium] receiver deployment dos via salt reuse
- 57482 - [SC - Critical] front running a donation can inflate the share causing users to lose funds
- 57426 - [SC - Medium] dynamic price signature replay allows unlimited minting at historical prices
- 57940 - [SC - Medium] deterministic address collision in cairo deployment causes dos and unintended receiver sharing
- 57203 - [SC - Medium] revised malicious accesstoken creator can steal gas via mintstaticprice or mintdynamicprice
- 57829 - [SC - High] incorrect fee implementation in paytovenue long payment path causes protocol fees to be permanently locked in escrow
- 57398 - [SC - Critical] incorrect platform subsidy processing in long payments causing venue payout failures
- 57877 - [SC - High] accesstoken creators can bypass fees so that platform address will receive 0 fees
- 56810 - [SC - Medium] accesstoken cross contract signature replay allows unauthorized minting on other collections
- 56907 - [SC - Critical] attacker can steal first depositor s asset with inflation attack
- 56850 - [SC - Critical] donation attack posible on staking sol because its totalasset uses asset balanceof
- 57399 - [SC - Critical] erc4626 staking lockbook breaks share fungibility partial transfers can dos withdrawals
- 57221 - [SC - High] incorrect processing fee calculation causes venue payouts to be misallocated
- 57519 - [SC - Medium] unbounded stake array allows permanent withdraw lock via dust deposits on behalf of victims
- 56860 - [SC - Medium] hash collision in signature verification
- 57813 - [SC - Critical] transfer recipients will pay unwarranted emergency withdrawal penalties for share positions they legitimately own
- 57809 - [SC - Critical] inflation of shares in staking contract
- 57800 - [SC - Medium] signature replay vulnerability in belongcheckin distributepromoterpayments
- 57799 - [SC - Low] retroactive lock period changes affect existing stakes
- 57796 - [SC - Medium] signature hashing collision in signatureverifier lets attacker deploy forged accesstoken credittoken metadata critical unintended alteration of what the nft represents
- 57701 - [SC - Insight] accesstoken collectionexpire is never checked allowing tokens to be minted even after the collection expires
- 57015 - [SC - Medium] unbounded array loop
- 57775 - [SC - Medium] paytovenue will revert due to notenoughlongs funds in the escrow contract
- 57628 - [SC - Critical] improper transfer can lead to funds been frozen
- 57061 - [SC - High] retroactive share recalculation causes royalty distribution failure
- 56941 - [SC - Critical] staking vault vulnerable to first depositor donation attack
- 57738 - [SC - Medium] name squatting front run on produce allows attacker to preempt legitimate creator and capture future mint revenue
- 57735 - [SC - Insight] whitelist bypass in static mint pricing trusting signed params whitelisted instead of on chain iswhitelisted leads to underpricing and access control violation
- 57724 - [SC - Medium] universal signature for produce allows front running and collection hijack
- 57723 - [SC - Medium] signature replay front run and timing control issues
- 57929 - [SC - Medium] produce function doesn t check if creator is the caller allowing frontrunning attacks
- 57284 - [SC - Medium] updating minimum staking period griefs previously unlocked users
- 57703 - [SC - Medium] dos with revert via unbounded loop
- 57892 - [SC - Insight] long tokens will be stuck in the escrow if customers exclusively use usdc payments in paytovenue
- 57663 - [SC - Insight] gas storage optimization erc1155info struct in structures sol can save one slot through field reordering
- 57898 - [SC - High] unprotected swap function allows sandwich attacks
- 57888 - [SC - High] referral tier upgrades freeze legacy royalties
- 57885 - [SC - High] dynamic share drift in royaltiesreceiverv2
- 57594 - [SC - Medium] signature collision from abi encodepacked adjacent strings enables unauthorized nft actions mint uri abuse
- 57635 - [SC - Critical] erc4626 share transfers desynchronize time lock ledger blocking standard withdrawals for recipients
- 57454 - [SC - Low] referral percentages schedule stuck on first configuration
- 57374 - [SC - Low] staking tier misclassification
- 57290 - [SC - High] mev sandwich attack vulnerability no user controlled slippage protection in token swaps
- 57327 - [SC - Medium] title front running leads to denial of service and unauthorized referral farming in creation functions
- 57432 - [SC - Insight] royaltiesreceiverv2 fails to distribute full balance when royalties percentages do not sum to 10000
- 57310 - [SC - Medium] unaccounted processing fees in long payment path
- 57298 - [SC - Critical] state sync omission in staking transfers forces transferred slong holders into penalized emergency exits
- 57296 - [SC - High] retroactive referral tier underpayment in royaltiesreceiverv2 due to dynamic shares applied to historical funds
- 57285 - [SC - Medium] incomplete signature in factory produce enables full accesstoken hijacking and direct fund theft
- 57060 - [SC - Medium] unconditional subsidy withdrawal in paytovenue leads to dos when venue s long pool is depleted
- 57423 - [SC - Medium] unbounded gas consumption in emergency redemption enables low cost dos against staking vault users
- 57039 - [SC - Critical] processing fee logic flaw in paytovenue causes permanent loss of platform revenue