Immunefi Audit CompetitionsFolks Finance
Reports by Severity
Critical
- 33269 - [SC - Critical] Logic flaw in UserLoanincreaseCollateral l
- 33311 - [SC - Critical] Infinite Interest rate bug
- 33533 - [SC - Critical] depositDatainterestRate is not correct
- 33665 - [SC - Critical] Collateral Inflation Exploit via Zero-Amou
- 33684 - [SC - Critical] Lack of available liquidity check when sen
- 33695 - [SC - Critical] Attacker can borrow more than the collater
- 33780 - [SC - Critical] Zero deposits can be used to artificially
- 33816 - [SC - Critical] Attacker can get unlimited loan for some m
- 33978 - [SC - Critical] Attacker can Inflate effectiveCollateralVa
- 34074 - [SC - Critical] Hub missing check for available liquidity
- 34190 - [SC - Critical] Liquidated users can mix and manipulate st
High
- 33630 - [SC - High] Incorrect calculation of loanBorrowbalance
- 33817 - [SC - High] Incorrect calculation of effective borrow valu
- 34050 - [SC - High] Vulnerability in getLoanLiquidity leads to und
- 34122 - [SC - High] Wrong borrow balance calculation in the getLoa
- 34179 - [SC - High] Incorrect Updates to pooldepositDatatotalAmoun
Medium
- 33272 - [SC - Medium] FrontRunning Attack on createAccount
- 33534 - [SC - Medium] denial of service vulnerability and possible
- 33542 - [SC - Medium] Attacker can create loan before users tx is
- 33546 - [SC - Medium] Adversaries can manipulate victims stable ra
- 33568 - [SC - Medium] Front-running vulnerability in cross-chain l
- 33589 - [SC - Medium] Anyone can call the BridgeRouter Recieve fun
- 33609 - [SC - Medium] Account creation can be frontrun making the
- 33611 - [SC - Medium] Adversary can perform a DoS on users createL
- 33614 - [SC - Medium] Front-Running Vulnerability in createAccount
- 33645 - [SC - Medium] Griefing an user from creating an account
- 33687 - [SC - Medium] Loan creation can be frontrun preventing the
- 33694 - [SC - Medium] stableBorrowRates are manipulatable through
- 33778 - [SC - Medium] The loan creation process can be griefed
- 33779 - [SC - Medium] The account creation process can be griefed
- 33869 - [SC - Medium] loanIds are easy to reproduce and front-runn
- 33880 - [SC - Medium] Front-Running Vulnerability in createUserLoa
- 33893 - [SC - Medium] Malicious users can DoS loan creations and d
- 33970 - [SC - Medium] User deposits can be blocked
- 33987 - [SC - Medium] Incorrect access control in receiveMessage l
- 34025 - [SC - Medium] Malicious user can DoS the creation of every
- 34028 - [SC - Medium] Denial of Service DoS vulnerability in UserL
- 34029 - [SC - Medium] Contract fails to mitigate potential critica
- 34066 - [SC - Medium] Account Creation Front-Running Vulnerability
- 34161 - [SC - Medium] Denial of Service via Front-Running in Loan
Low
- 33280 - [SC - Low] NodeManagersupportsInterface doesnt follow EIP-
- 33353 - [SC - Low] Incorrect implementation of Time-Weighted Avera
- 33356 - [SC - Low] All data in _userLoans mapping will not be dele
- 33443 - [SC - Low] StalenessCircuitBreakerNode checks if the last
- 33454 - [SC - Low] unsafe casting will lead to break of PythNode O
- 33540 - [SC - Low] ChainlinkNode uses cached decimals in the calcu
- 33566 - [SC - Low] RepayWithCollateral will almost always fail in
- 33596 - [SC - Low] Incorrect rounding direction in HubPoolLogicupd
- 33631 - [SC - Low] Wrong implementation of chainLink getTwapPrice
- 33643 - [SC - Low] PriceFeed from PythNode will always revert for
- 33675 - [SC - Low] PythNodeprocess can revert because of incorrect
- 33787 - [SC - Low] Function PythNodeprocess doesnt handle correctl
- 33807 - [SC - Low] updateInterestRate uses incorrect reference of
- 33870 - [SC - Low] convToRepayBorrowAmount calculation is incorrec
- 33885 - [SC - Low] Incorrect prices will be returned if the NodeTy
- 33923 - [SC - Low] Function HubPoolLogicupdateWithWithdraw doesnt
- 33947 - [SC - Low] During liquidations when borrowToRepay collater
- 33950 - [SC - Low] pythnode oracle unexpected revert
- 33953 - [SC - Low] Calling process function will not revert even i
- 33981 - [SC - Low] The PythNode library process function implement
- 34030 - [SC - Low] Incorrect rounding down in HubPoolLogicupdateWi
- 34047 - [SC - Low] Adversaries can create a position that is nearl
- 34052 - [SC - Low] withdraw doesnt round in favour of protocol for
- 34054 - [SC - Low] In liquidation loanPoolcollateralUsed doesnt ge
- 34069 - [SC - Low] repayWithCollateral may revert when repay samll
- 34076 - [SC - Low] Wrong way of deriving message keys using destin
- 34085 - [SC - Low] partial repayment with collaterals will revert
- 34124 - [SC - Low] Smart contract cannot be accessed during the no
- 34127 - [SC - Low] Liquidator gets more debt than usual
- 34132 - [SC - Low] Liquidation bonus incorrectly inflates repayBor
- 34148 - [SC - Low] Full liquidations will fail for certain unhealt
- 34150 - [SC - Low] Failed messages never expire and can be replaye
- 34153 - [SC - Low] TWAP query by chainlink is wrong according to c
- 34158 - [SC - Low] NodeManagersupportsInterface returns false for
- 34169 - [SC - Low] Potential revert in PythNode library due to inc
- 34174 - [SC - Low] Bug in liquidation logic leads to stealing fund
Insight
- 33258 - [SC - Insight] Usage of floating pragma
- 33376 - [SC - Insight] BridgeRouterreceiveMessage Allows Message R
- 33441 - [SC - Insight] Protocol uses Pyth to fetch price which is
- 33526 - [SC - Insight] Need to check returnAdapterId
- 33588 - [SC - Insight] The liquidator can make the protocol incur
- 33644 - [SC - Insight] Insufficient msgvalue validation for Wormho
- 33652 - [SC - Insight] BridgeRouters Unprotected Reversal Function
- 33670 - [SC - Insight] Violator can deny his liquidation by front
- 33713 - [SC - Insight] Some transactions can revert when nodetype
- 33746 - [SC - Insight] Rounding down to zero leads to liquidate fu
- 33852 - [SC - Insight] Small positions will not get liquidated
- 33935 - [SC - Insight] Liquidations dont ensure the violator loan
- 34183 - [SC - Insight] rebalanceUp could be used to lower the user
- 34188 - [SC - Insight] BridgeRouterHub can add address adapter
Reports by Type
Smart Contract
- 33258 - [SC - Insight] Usage of floating pragma
- 33269 - [SC - Critical] Logic flaw in UserLoanincreaseCollateral l
- 33272 - [SC - Medium] FrontRunning Attack on createAccount
- 33280 - [SC - Low] NodeManagersupportsInterface doesnt follow EIP-
- 33311 - [SC - Critical] Infinite Interest rate bug
- 33353 - [SC - Low] Incorrect implementation of Time-Weighted Avera
- 33356 - [SC - Low] All data in _userLoans mapping will not be dele
- 33376 - [SC - Insight] BridgeRouterreceiveMessage Allows Message R
- 33441 - [SC - Insight] Protocol uses Pyth to fetch price which is
- 33443 - [SC - Low] StalenessCircuitBreakerNode checks if the last
- 33454 - [SC - Low] unsafe casting will lead to break of PythNode O
- 33526 - [SC - Insight] Need to check returnAdapterId
- 33533 - [SC - Critical] depositDatainterestRate is not correct
- 33534 - [SC - Medium] denial of service vulnerability and possible
- 33540 - [SC - Low] ChainlinkNode uses cached decimals in the calcu
- 33542 - [SC - Medium] Attacker can create loan before users tx is
- 33546 - [SC - Medium] Adversaries can manipulate victims stable ra
- 33566 - [SC - Low] RepayWithCollateral will almost always fail in
- 33568 - [SC - Medium] Front-running vulnerability in cross-chain l
- 33588 - [SC - Insight] The liquidator can make the protocol incur
- 33589 - [SC - Medium] Anyone can call the BridgeRouter Recieve fun
- 33596 - [SC - Low] Incorrect rounding direction in HubPoolLogicupd
- 33609 - [SC - Medium] Account creation can be frontrun making the
- 33611 - [SC - Medium] Adversary can perform a DoS on users createL
- 33614 - [SC - Medium] Front-Running Vulnerability in createAccount
- 33630 - [SC - High] Incorrect calculation of loanBorrowbalance
- 33631 - [SC - Low] Wrong implementation of chainLink getTwapPrice
- 33643 - [SC - Low] PriceFeed from PythNode will always revert for
- 33644 - [SC - Insight] Insufficient msgvalue validation for Wormho
- 33645 - [SC - Medium] Griefing an user from creating an account
- 33652 - [SC - Insight] BridgeRouters Unprotected Reversal Function
- 33665 - [SC - Critical] Collateral Inflation Exploit via Zero-Amou
- 33670 - [SC - Insight] Violator can deny his liquidation by front
- 33675 - [SC - Low] PythNodeprocess can revert because of incorrect
- 33684 - [SC - Critical] Lack of available liquidity check when sen
- 33687 - [SC - Medium] Loan creation can be frontrun preventing the
- 33694 - [SC - Medium] stableBorrowRates are manipulatable through
- 33695 - [SC - Critical] Attacker can borrow more than the collater
- 33713 - [SC - Insight] Some transactions can revert when nodetype
- 33746 - [SC - Insight] Rounding down to zero leads to liquidate fu
- 33778 - [SC - Medium] The loan creation process can be griefed
- 33779 - [SC - Medium] The account creation process can be griefed
- 33780 - [SC - Critical] Zero deposits can be used to artificially
- 33787 - [SC - Low] Function PythNodeprocess doesnt handle correctl
- 33807 - [SC - Low] updateInterestRate uses incorrect reference of
- 33816 - [SC - Critical] Attacker can get unlimited loan for some m
- 33817 - [SC - High] Incorrect calculation of effective borrow valu
- 33852 - [SC - Insight] Small positions will not get liquidated
- 33869 - [SC - Medium] loanIds are easy to reproduce and front-runn
- 33870 - [SC - Low] convToRepayBorrowAmount calculation is incorrec
- 33880 - [SC - Medium] Front-Running Vulnerability in createUserLoa
- 33885 - [SC - Low] Incorrect prices will be returned if the NodeTy
- 33893 - [SC - Medium] Malicious users can DoS loan creations and d
- 33923 - [SC - Low] Function HubPoolLogicupdateWithWithdraw doesnt
- 33935 - [SC - Insight] Liquidations dont ensure the violator loan
- 33947 - [SC - Low] During liquidations when borrowToRepay collater
- 33950 - [SC - Low] pythnode oracle unexpected revert
- 33953 - [SC - Low] Calling process function will not revert even i
- 33970 - [SC - Medium] User deposits can be blocked
- 33978 - [SC - Critical] Attacker can Inflate effectiveCollateralVa
- 33981 - [SC - Low] The PythNode library process function implement
- 33987 - [SC - Medium] Incorrect access control in receiveMessage l
- 34025 - [SC - Medium] Malicious user can DoS the creation of every
- 34028 - [SC - Medium] Denial of Service DoS vulnerability in UserL
- 34029 - [SC - Medium] Contract fails to mitigate potential critica
- 34030 - [SC - Low] Incorrect rounding down in HubPoolLogicupdateWi
- 34047 - [SC - Low] Adversaries can create a position that is nearl
- 34050 - [SC - High] Vulnerability in getLoanLiquidity leads to und
- 34052 - [SC - Low] withdraw doesnt round in favour of protocol for
- 34054 - [SC - Low] In liquidation loanPoolcollateralUsed doesnt ge
- 34066 - [SC - Medium] Account Creation Front-Running Vulnerability
- 34069 - [SC - Low] repayWithCollateral may revert when repay samll
- 34074 - [SC - Critical] Hub missing check for available liquidity
- 34076 - [SC - Low] Wrong way of deriving message keys using destin
- 34085 - [SC - Low] partial repayment with collaterals will revert
- 34122 - [SC - High] Wrong borrow balance calculation in the getLoa
- 34124 - [SC - Low] Smart contract cannot be accessed during the no
- 34127 - [SC - Low] Liquidator gets more debt than usual
- 34132 - [SC - Low] Liquidation bonus incorrectly inflates repayBor
- 34148 - [SC - Low] Full liquidations will fail for certain unhealt
- 34150 - [SC - Low] Failed messages never expire and can be replaye
- 34153 - [SC - Low] TWAP query by chainlink is wrong according to c
- 34158 - [SC - Low] NodeManagersupportsInterface returns false for
- 34161 - [SC - Medium] Denial of Service via Front-Running in Loan
- 34169 - [SC - Low] Potential revert in PythNode library due to inc
- 34174 - [SC - Low] Bug in liquidation logic leads to stealing fund
- 34179 - [SC - High] Incorrect Updates to pooldepositDatatotalAmoun
- 34183 - [SC - Insight] rebalanceUp could be used to lower the user
- 34188 - [SC - Insight] BridgeRouterHub can add address adapter
- 34190 - [SC - Critical] Liquidated users can mix and manipulate st