Immunefi Audit CompetitionsPlume | Attackathon
Reports by Severity
Critical
- 53037 - [SC - Critical] commission changes can retroactively affect user rewards
- 53022 - [SC - Critical] funds are not properly refunded to user which calls for swap on the dex aggregator
- 53011 - [SC - Critical] uncleaned partial approval consumption in dex aggregator integration leads to permanent dos
- 52980 - [SC - Critical] partial fills strand source tokens in the wrapper and leave dangerous residual allowances
- 51352 - [SC - Critical] user will lose the unspent amount when executing partial swaps via 1inch
- 52178 - [SC - Critical] user will lose the unspent amount when executing partial swaps via okxrouter
- 51283 - [SC - Critical] permanent freeze of user token due to unhandled partial fill refunds for swap via 1inch in dexaggregatorwrapperwithpredicateproxy
- 52923 - [SC - Critical] partial fill traps source token residual inside the wrapper and leaves unsafe residual allowance
- 51847 - [SC - Critical] dos via dust leftover in erc 20 approvals
- 49863 - [SC - Critical] dex aggregator erc20 token theft
- 49854 - [SC - Critical] dex aggregator partial fill token loss
High
- 53077 - [SC - High] permanent fund lock due to flawed remainder logic in distributeyield
- 53072 - [SC - High] ceil vs floor rounding mismatch causes systematic underpayment and unclaimed yield leakage
- 53070 - [SC - High] validator commission update during max allowed commission change causes incorrect reward calculations
- 53061 - [SC - High] asymmetric rounding in commission ceil for users floor for validators enables per segment rounding loss validators can amplify via frequent commission checkpoints
- 53051 - [SC - High] unconsented stakeonbehalf enables third party gas griefing dos by bloating uservalidators breaking withdraw claimall
- 53047 - [SC - High] the jackpot eligibility check uses stale storage data instead of the freshly calculated streak
- 53043 - [SC - High] handlerandomness doesn t properly account for current streak which could result in the user spinning losing a jackpot
- 53039 - [SC - High] rewards and commissions accrued in the interval before a slash might be lost
- 53034 - [SC - High] arctokenfactory doesn t properly handle role management which allows users to arbitrary upgrade their arctoken s implementation
- 53028 - [SC - High] there is an asymmetric rounding issue that is can cause a theft of unclaimed yield in reward or commission accounting
- 53025 - [SC - High] commission on removed tokens is unclaimable
- 53020 - [SC - High] there are functions which when inevitably used could result in wrongly accruing yield for inactive validators which can make the protocol insolvent
- 53018 - [SC - High] owed rewards could be lost for some users for periods before slashing time due to incorrect logic
- 53016 - [SC - High] arctokenpurchase doesn t allow rwa token owners to recover accrued yield from stored arctokens waiting for sale
- 53001 - [SC - High] yield tokens become stuck in arctokenpurchase contract when distributing yield during active sales
- 52996 - [SC - High] users can claim rewards for newly added reward tokens even when the validator they staked for was inactive during some time interval
- 52995 - [SC - High] validators lose access to historical reward tokens when tokens are removed
- 52588 - [SC - High] retroactive reward accrual for newly added tokens when validator was inactive
- 52986 - [SC - High] jackpot check uses previous streakcount instead of current computed streak denying jackpot on first eligible day
- 52576 - [SC - High] flaw in raffle determinereward in jackpot prize calculation after week 12
- 52889 - [SC - High] inactive validators accrue rewards for new tokens
- 52286 - [SC - High] off by one error in jackpot eligibility check leads to denial of legitimate rewards
- 52573 - [SC - High] unconsented stakeonbehalf enables unbounded gas consumption via uservalidators growth causing dos at scale in claimall withdraw
- 52983 - [SC - High] validator will loose commission for the tokens which are removed from the reward tokens but they still have commission left to be claimed
- 52285 - [SC - High] incorrect dust handling in yield distribution leads to permanent fund lock
- 52572 - [SC - High] a legitimate arc token holder can be denied his yield
- 52865 - [SC - High] inconsistency in how stake cooldown is handled due to off by one error
- 51999 - [SC - High] logical flaw in validator reactivation and addrewardtoken allows claiming rewards for validators in inactive periods
- 52278 - [SC - High] incorrect streak check in jackpot eligibility leads to unfair reward denial
- 51994 - [SC - High] permanent loss of validator commission upon reward token removal
- 52560 - [SC - High] incorrect current streak used when calculating whether the jackpot should be awarded or not
- 52849 - [SC - High] claimers who claim after slash inactive updaterewardpertokenforvalidator which advances validatorlastupdatetimes to be more than slashtimestamp will lose rewards for a segment
- 51992 - [SC - High] dust accumulation in arctoken during yield distribution
- 52254 - [SC - High] arctoken theft beyond unclaimed yield during distribution
- 52847 - [SC - High] no function to recover the remained yield by distributeyieldwithlimit
- 51754 - [SC - High] double yield distribution via token transfers between distributeyieldwithlimit calls
- 52527 - [SC - High] the validator admin might claim less commission token when validatorfacet requestcommissionclaim is called
- 52845 - [SC - High] distributeyieldwithlimit lacks snapshot between batches allowing state changes to break distribution and lock yield
- 51589 - [SC - High] tokencreator retains upgrade rights fix remains insufficient finding 01 immunefi report
- 52517 - [SC - High] missing point in time snapshot in batched yield distribution enables double claims and permanent fund lock
- 52218 - [SC - High] creator retains default admin role allowing bypass of upgrade restrictions
- 51369 - [SC - High] unbounded iteration gas dos in validatetokenforclaim
- 51987 - [SC - High] validators will be able to steal more commission from users that isn t the commission to be charged
- 51090 - [SC - High] malicious user can steal yields when arctoken distributeyieldwithlimit is used
- 52833 - [SC - High] bypass the fix of immunefi audit imm crit 01 token creator can upgrade arctoken implementation
- 51558 - [SC - High] arctoken holder can receive yield twice from distributeyieldwithlimit
- 50796 - [SC - High] jackpot eligibility uses stale streak
- 52500 - [SC - High] missing commission checkpoint initialization leads to retroactive commission theft of user rewards
- 52198 - [SC - High] balance manipulation between batches leading to inflated payout and dos
- 52499 - [SC - High] arctoken factory s admin cannot upgrade an arctoken
- 50784 - [SC - High] any arc token creator can upgrade the implementation
- 52964 - [SC - High] if a new reward token is added during a the period a validator is inactive the validator will still earn rewards commission for some of the duration in which they were inactive
- 51324 - [SC - High] rounding in commission accounting burns delegator rewards
- 52803 - [SC - High] canrecoverfromcooldown is inconsistent when slash and cooldown maturity occur in the same block
- 52961 - [SC - High] theft of yield from the distributor
- 52798 - [SC - High] integer division remainder loss in batched yield distribution causes permanent fund lock
- 51961 - [SC - High] attackers can deny commission rewards to validators by repeatedly calling forcesettlevalidatorcommission
- 51530 - [SC - High] validators can not claim pending accrued commission when reward tokens have been removed from the isrewardtoken mapping
- 52956 - [SC - High] state inconsistency in batched yield distribution leads to direct theft of user funds and protocol insolvency
- 49787 - [SC - High] batched yield distribution doesn t account for transfers purchases between batches
- 51051 - [SC - High] inactive validator reward accrual bypass
- 52955 - [SC - High] a commission rate checkpoint is not created when adding a validator despite the commission rate being set leading to loss of validator commission
- 52165 - [SC - High] user can t claim reward erc20 tokens since rewards transfer will revert
- 51728 - [SC - High] users can claim rewards for inactive validator periods due to incorrect checkpoint accrual
- 50735 - [SC - High] some yield tokens will be stuck in contract due to incorrect lastprocessedindex calculation
- 51946 - [SC - High] commission claims fail for removed reward tokens
- 52464 - [SC - High] commission rounding mismatch under payment bug
- 52787 - [SC - High] batched yield distribution rounding in arctoken permanently freezes unclaimed funds and misreports payouts
- 51041 - [SC - High] streak count misuse in jackpot eligibility allows theft of user funds
- 52944 - [SC - High] the requestcommisionclaim function can only claim commission on tokens that are currently reward tokens
- 50713 - [SC - High] deployer s default admin role enables self grant of upgrader role bypassing implementation whitelist
- 51941 - [SC - High] token creator can revoke factory s upgrade capability permanently blocking upgrades
- 52780 - [SC - High] timestamp manipulation in forcesettlevalidatorcommission leads to permanent loss of staker rewards
- 50350 - [SC - High] stakingfacet stakeonbehalf allows to prevent withdraws
- 49731 - [SC - High] theft on re added tokens
- 52770 - [SC - High] unbounded gas consumption via stakeonbehalf manipulation
- 52931 - [SC - High] validators can not claim their commissions after the reward token removal
- 51479 - [SC - High] inaccurate reward calculation post validator slashing due to premature timestamp update on token removal
- 52449 - [SC - High] broken streaks still pass jackpot eligibility in spin contract
- 49710 - [SC - High] cross batch state manipulation in yield distribution allows double dipping of yield funds
- 52104 - [SC - High] removed reward tokens block validator commission claims
- 51456 - [SC - High] token creator can revoke the upgrader role from the factory in order to avoid upgrades
- 50951 - [SC - High] inconsistent streak count usage between jackpot and raffle ticket calculations
- 52439 - [SC - High] dust accumulation in batched yield payouts leaves tokens stranded
- 49700 - [SC - High] validator commission can be blocked
- 51218 - [SC - High] oracle callback timing vulnerability causes jackpot prize loss
- 51912 - [SC - High] mismatched rounding rules in reward logic library results in two fold loss of earnings
- 51658 - [SC - High] yield distribution in batches let the same tokens collect rewards in multiple batches stealing yield from other users
- 52084 - [SC - High] unstaking before reward token removal leads to incorrect reward accrual on re addition
- 52711 - [SC - High] in validatorfacet validator cannot claims commissions of removed tokens
- 51452 - [SC - High] stakeonbehalf function enables out of gas dos
- 51414 - [SC - High] attacker can drain yield by transferring tokens to other address in yield batch distributions
- 50275 - [SC - High] eligible user loses jackpot
- 52424 - [SC - High] there is a retroactive commission miscalculation in plumerewardlogic
- 50252 - [SC - High] rounding excess yield tokens become permanently stuck when last holder is yield restricted
- 51197 - [SC - High] arc token owner can take upgrader role for themselves lockout the factory and upgrade the contract without the knowledge of the factory
- 50924 - [SC - High] validators are not able to claim their accrued commission when the reward token is removed
- 52680 - [SC - High] holders length changing when distributing limit with limit could lead to case where new holders unfairly claim yield and yield is permanently frozen
- 51653 - [SC - High] permanent loss of staker rewards after slashing when validator records are cleared
- 52409 - [SC - High] asymmetric commission rounding creates systematic accounting drift
- 50916 - [SC - High] token creators can bypass factory upgrade controls via wrong code implementation of default admin role in arctokenfactory sol
- 50560 - [SC - High] inconsistent commission rounding traps user validator funds
- 49616 - [SC - High] user can steal rewards
- 52390 - [SC - High] validateistoken blocks validators from claiming earned rewards from removed tokens
- 50527 - [SC - High] attacker can steal yield during batch distribution
- 50860 - [SC - High] logic error in jackpot eligibility check leads to systematic theft of user rewards
- 52667 - [SC - High] commission is not added at point of adding validator hence stakers that stake before the first checkpoint would always use the current commission
- 51878 - [SC - High] timing misalignment between campaign days and calendar days allows double spinning on high probability jackpot days
- 52649 - [SC - High] token creator can seize upgrade control bypassing factory whitelist and enabling theft of funds
- 50822 - [SC - High] deployer can cpgrade arctoken to malicious implementation and steal all user funds
- 50167 - [SC - High] retroactive reward drain via incomplete reward debt reset
- 52371 - [SC - High] distributeyieldwithlimit is vulnerable to inter batch balance and holders array mutations
- 52634 - [SC - High] batch yield distribution has a mathematical flaw that enables economic manipulation
- 50519 - [SC - High] rewardsfacet reintroducing an old reward token will result in wrong accounting leading to theft of yield
- 52347 - [SC - High] improper handling of yield distribution state in distributeyieldwithlimit leads to revert freezing users yield
- 50507 - [SC - High] non atomic yield distribution may lead to theft of yield
- 51860 - [SC - High] missing access control in stakeonbehalf lets anyone bloat another user s validator list leading to permanent fund lock via gas exhaustion dos
- 51124 - [SC - High] validator would loss commission fee if the rewards token are removed
- 52601 - [SC - High] in spin handlerandomness jackpot eligibility uses outdated streakcount instead of updated streak
- 51842 - [SC - High] unclaimed staker rewards lost when admin clears validator records without checking pending rewards
- 50490 - [SC - High] user loses reward tokens during validator user relationship clearing
- 51813 - [SC - High] malicious user can grief victims by staking them across many validators leading to fund freezing
- 50477 - [SC - High] validator loses all accrued commission when reward token is removed
- 49939 - [SC - High] initial timestamp mismatch might lead to users being able to spin twice in the same day
- 50450 - [SC - High] logic error in streak validation causes legitimate jackpot wins to be denied violating reward contract expectations
- 50433 - [SC - High] validator list griefing unrestricted stakeonbehalf allows user asset freeze permanently
- 50425 - [SC - High] active non slashed validators cannot claim rewards when a reward token is disabled
- 50412 - [SC - High] illegitimate reward claim after unstake due to overlapping reward rate checkpoints
- 50409 - [SC - High] validator will lose comission
- 49787 - [SC - High] batched yield distribution doesn t account for transfers purchases between batches
Medium
- 53048 - [SC - Medium] approval logic can break on non standard erc 20s usdt style and leave allowances loose
- 53035 - [SC - Medium] share lock applied to wrapper instead of end user breaks transfers or bypasses lock
- 53021 - [SC - Medium] deposit and bridge workflow bricked by immediate share lock users cannot bridge immediately after deposit
- 52988 - [SC - Medium] deposit function dos
- 52290 - [SC - Medium] deposit function in tellerwithmultiassetsupportpredicateproxy is completely broken due to wrong share lock
- 52982 - [SC - Medium] non standard erc20 approvals usdt like cause repeat call failures after partial fills
- 51988 - [SC - Medium] plumerewardlogic calculaterewardswithcheckpointsview lacking of checking if the validator is inactive but not slashed
- 52841 - [SC - Medium] token admin can dos admin to not let admin change purchase token
- 52203 - [SC - Medium] griefing attack on arctokenpurchase setpurchasetoken function via front running
- 52974 - [SC - Medium] when the approval to the okxapprover is not fully spent the deposit function will be blocked
- 51547 - [SC - Medium] approval race condition with safeapprove leads to transaction reverts
- 51043 - [SC - Medium] core deposit and depositandbridge functionality in tellerwithmultiassetsupportpredicateproxy is non functional due to flawed sharelockperiod logic
- 49732 - [SC - Medium] malicious token admin can permanently block setpurchasetoken
- 51684 - [SC - Medium] unbounded gas consumption in removestakerfromallvalidators leads to denial of service preventing users with large validator counts from removing associations and potentially lock
- 50340 - [SC - Medium] any arctoken admin can block the setting update of the purchase token indefinitely
- 51476 - [SC - Medium] validators can t claim their accrued commission if they are made inactive
- 52925 - [SC - Medium] usdt like approval hygiene can block subsequent operations after partial fill leaves non zero allowance
- 52732 - [SC - Medium] permanent dos of purchase token change
- 49705 - [SC - Medium] two vectors for unbounded gas consumption due to the normal raffle operations
- 51666 - [SC - Medium] inactive validators blocked from claiming accrued commission
- 52719 - [SC - Medium] inactive validators blocked from claiming commissions despite passed timelock
- 52075 - [SC - Medium] arctokenpurchase contract is a token holder and may be yield recipient
- 50937 - [SC - Medium] non zero approve pattern causes permanent freeze of token deposits e g usdt due to erc20 incompatibility
- 51909 - [SC - Medium] inconsistent commission claim logic denies legitimate claims for inactive validators
- 52690 - [SC - Medium] dos of smart contracts on bridging functions
- 51180 - [SC - Medium] function is vulnerable to gas griefing
- 51899 - [SC - Medium] partial distribution of yield will fail if the totalefficentive supply increases
- 51613 - [SC - Medium] yield tokens can be stuck in arctokenpurchase plumestakingrewardtreasury or other defi protocols when distributeyield is called
- 52397 - [SC - Medium] repeated approve without zero reset can revert on nonstandard erc20s blocking deposits
- 52031 - [SC - Medium] insufficient access control in token sales management leads to permanent griefing attack
- 51887 - [SC - Medium] safeapprove will cause revert of usdt and similar erc20 token
- 52026 - [SC - Medium] claimall could revert because of unbounded gas consumptions
- 52620 - [SC - Medium] permanently dos to arctokenpurchase contract
- 49963 - [SC - Medium] anyone can create an arctoken and block the setpurchasetoken function
- 51801 - [SC - Medium] supra callback allows for theft of gas
- 51777 - [SC - Medium] denial of service on depositandbridge function for sharelockperiod is non zero
- 50428 - [SC - Medium] reverting on callback increases chances of winning
- 49817 - [SC - Medium] inactive validators are prevented to claim to eligible commission rewards
Low
- 53069 - [SC - Low] dynamic cooldown interval changes cause unexpected fund lockup extensions
- 53063 - [SC - Low] maxvalidatorpercentage can be used to dos protocol staking
- 53059 - [SC - Low] reward rate checkpoints are used but are never set
- 53056 - [SC - Low] native withdraw to msg sender only non payable contract stakers cannot withdraw permanent funds lock
- 53038 - [SC - Low] distributeyield can be frontrun to sandwich rewards we can force ourselves to be the last holder and get unfairly big bonuses
- 53015 - [SC - Low] raffle does not invalidate used tickets breaking fairness
- 52998 - [SC - Low] minor delays from oracle can unfairly reset users streak
- 52896 - [SC - Low] pause gate is present but no way to pause
- 52891 - [SC - Low] staking and unstaking immediately an amount little less than the original staked amount leaves dust stake amounts in the system
- 52589 - [SC - Low] in distribute yield function if there are no legitimate users i e no restricted users the funds will remain stuck
- 52990 - [SC - Low] uint8 truncation and missing cap on week index can return wrong zero jackpot amounts low contract fails to deliver promised returns
- 52890 - [SC - Low] no recipient yield distribution locks yield tokens on arctoken efftotal 0
- 52870 - [SC - Low] cooldown extension logic may lead to locked funds
- 52277 - [SC - Low] race condition in streak calculation leads to unfair streak reset for users spinning near utc day change
- 51771 - [SC - Low] unsafe downcast of uint256 to uint8 will lead to silent overflow
- 51989 - [SC - Low] event restrictionscreated always emits msg sender as owner
- 51596 - [SC - Low] unsafe uint256 to uint8 downcast causes integer overflow leading to unauthorized jackpot payouts after week 255
- 52241 - [SC - Low] unexposed pauseable functionality
- 51746 - [SC - Low] depositandbridge function of tellerwithmultiassetsupportpredicateproxy sol can not be paused
- 52519 - [SC - Low] missing eligibility check before fund transfer in distributeyield leads to permanent loss of yield tokens
- 51391 - [SC - Low] enabletoken function overwrites amountsold to zero causing permanent loss of sales history
- 52843 - [SC - Low] the zero address cannot be whitelisted which means during restrictions minting and burning cannot work
- 52979 - [SC - Low] whitelistrestrictions unintentionally disables mint and burn when transfers are restricted
- 52976 - [SC - Low] turning on transfer restriction permanently blocks minting and burning
- 51567 - [SC - Low] contract cannot be paused missing public pause and unpause functions
- 52202 - [SC - Low] failure to invalidate winning tickets allows multiple wins from single entry
- 51980 - [SC - Low] unstake cooldown period is mistakenly reset on each claim resulting in temporary frozen funds
- 51979 - [SC - Low] getaccruedcommission returns outdated accrued commission
- 51070 - [SC - Low] winning raffle ticket can be re used to maintain unfair advantage over other players in raffle
- 52186 - [SC - Low] incorrect reward calculation for slashed validators due to single segment time handling
- 51970 - [SC - Low] spin streak computation relies on oracle callback time any third party delay can reset the user s streak and block jackpot eligibility
- 52489 - [SC - Low] when users perform unstake operations in batches it may cause some funds to be frozen for an additional period of time
- 50783 - [SC - Low] validator percentage cap does not work properly
- 51320 - [SC - Low] malicious teller parameter allow event data manipulation
- 51966 - [SC - Low] totalamountclaimable reverts instead of returning the claimable reward for historical tokens
- 50399 - [SC - Low] broken access control in particular contract functions due lack of pause unpause functionality
- 50745 - [SC - Low] single cooldown entry design causes timer reset on multiple unstakes leading to extended lock periods
- 52796 - [SC - Low] whitelist restriction in arctoken blocks all minting and burning
- 51296 - [SC - Low] arctokenpurchase withdrawal breaks view functions
- 51951 - [SC - Low] a global blocking check in claimprize prevents individual winner claims until all winners are drawn
- 52794 - [SC - Low] remainingforsale not updated after withdrawunsoldarctokens will cause following buy revert
- 52948 - [SC - Low] jackpot reward rejected at exact threshold
- 51525 - [SC - Low] unfair yield distribution to last holder due to flawed dust handling
- 51519 - [SC - Low] unstake does not validate users remaing stake
- 50721 - [SC - Low] winners cannot claim prizes until all winners have been drawn in raffle claimprize
- 51713 - [SC - Low] missing minimum stake validation in unstake operations
- 51286 - [SC - Low] event restrictionscreated uses wrong owner
- 51510 - [SC - Low] bypass of maxvalidatorpercentage allows a validator to exceed the decentralisation cap
- 51034 - [SC - Low] sales information is lost when enabling token
- 52129 - [SC - Low] previewyielddistribution reverts instead of returning zero when no tokens are in circulation
- 50694 - [SC - Low] spins occuring close to midnight lead to users streaks being unfairly broken due to vrf callback delay
- 51929 - [SC - Low] deactivating istransferallowed indirectly doses minting burning functionality
- 51502 - [SC - Low] enabling transfer restrictions permanently blocks minting and burning
- 51276 - [SC - Low] arctokenpurchase re enabling active token sales causes accounting corruption and token loss
- 50977 - [SC - Low] tellerwithmultiassetsupportpredicateproxy contract cannot be emergency paused
- 52750 - [SC - Low] percentage limit bypass via unstaking from other validators
- 50343 - [SC - Low] cooldown reset vulnerability
- 52113 - [SC - Low] stakingfacet unstake uint16 validatorid uint256 amount can be abused to bypass minstakeamount
- 52446 - [SC - Low] withdrawing unsold tokens desynchronizes sale accounting
- 51457 - [SC - Low] getaccruedcommission reverts when token was removed instead of returning the accrued commission
- 51455 - [SC - Low] inflated earned ui rewards when validator stake is zero due to missing totalstaked guard in view logic
- 52436 - [SC - Low] getaccruedcommission could return an inaccurate value
- 49698 - [SC - Low] coordinated validator attack delays slashing and enables commission theft
- 51910 - [SC - Low] inconsistent yield token transfer logic causes permanent loss of yield in distributeyield
- 51451 - [SC - Low] token freezing via whitelist restriction bypass
- 51201 - [SC - Low] contracts without payable entry points cannot withdraw nor claim rewards
- 52710 - [SC - Low] mint burn are blocked when whitelist restrictions are enabled
- 50624 - [SC - Low] there is a missing emergency pause in predicate proxy
- 52915 - [SC - Low] yield are transferred before eligibility check potentially leading to freezing of funds
- 51412 - [SC - Low] token admin can withdraw the token from the purchase contract making the token balance to be less than the totalamountforsale
- 52706 - [SC - Low] multi quantity prize claims revert until all winners are drawn freezing early winners
- 52422 - [SC - Low] using the current time in geteffectiverewardrateat will result in incorrect reward calculation for an entire duration of a time segment
- 49647 - [SC - Low] pausable functions are not exposed
- 52041 - [SC - Low] in arctoken attacker can reposition to last holder and capture entire yield remainder
- 50922 - [SC - Low] unstaking partially will extend the cooldown time for previously unstaked amount too
- 52901 - [SC - Low] wrapped week index can mis price jackpot table after long uptime
- 50225 - [SC - Low] user can bypass minstakeamount checking
- 49623 - [SC - Low] unstaking allows going below minimum stake
- 50914 - [SC - Low] bypass of minimum stake enforcement via partial unstake
- 50551 - [SC - Low] staked dust positions are not properly prevented
- 51162 - [SC - Low] missing pause control implementation in tellerwithmultiassetsupportpredicateproxy
- 50889 - [SC - Low] arctokenpurchase withdrawunsoldarctokens fails to reduce totalamountforsale leaving availability counters wrong
- 52393 - [SC - Low] burns blocked by both sides whitelist with zero address exclusion when restrictions are enabled
- 50195 - [SC - Low] unfair yield distribution due to remainder allocation to last holder
- 51882 - [SC - Low] unnecessary claiming restriction in raffle contract prevents winners from claiming prizes until all winners are drawn
- 52669 - [SC - Low] token minting is blocked for whitelisted addresses when transfersallowed is false
- 51146 - [SC - Low] getmaxnumberoftokens returns wrong max number of tokens available to buy
- 52027 - [SC - Low] WhitelistRestrictions.sol: Mint & Burn Operations Blocked When Transfers Disabled
- 50839 - [SC - Low] last holder always gets more yield
- 51863 - [SC - Low] lack of winning ticket removal in handlewinnerselection leads to unfair prize distribution and economic exploitation
- 50120 - [SC - Low] arctokens cannot be burned or minted when transfers are restricted
- 51132 - [SC - Low] tellerwithmultiassetsupportpredicateproxy cannot be paused unpaused
- 50082 - [SC - Low] protocol lets validators operate with dust amounts making attacks risk free
- 51129 - [SC - Low] boringvault proxies do not support smart contract wallets
- 51850 - [SC - Low] upgradetoken can not initialize an upgraded token because the data variable of upgradetoandcall is hardcoded to empty string
- 52339 - [SC - Low] loss of daily streak and jackpot eligibility due to supra generator callback delay and on callback time usage in spin sol
- 51122 - [SC - Low] arctokenpurchase enabletoken can reset the amountsold to 0
- 52327 - [SC - Low] unfair yield distribution due to last holder bias
- 50040 - [SC - Low] missing pause controls eth refund flaws and miscalculated shares enable fund loss and protocol inconsistency in depositandbridge
- 52314 - [SC - Low] unsold token withdrawal causes permanent inventory mismatch
- 51836 - [SC - Low] contract cannot be paused despite inheriting pausable
- 50493 - [SC - Low] immutable proxy implementation mapping in restrictionsfactory breaks upgrade logic
- 52312 - [SC - Low] cooldown coalescing bug unintended cooldown extension for prior unstakes
- 51816 - [SC - Low] yield distribution can be front run to steal rounding remainder as last holder
- 50022 - [SC - Low] missing admin pause unpause functions in tellerwithmultiassetsupportpredicateproxy contract
- 50487 - [SC - Low] cross campaign jackpot denial due to state pollution
- 49941 - [SC - Low] permanent freezing of yield tokens due to flawed check in distribution logic
- 51802 - [SC - Low] temporary freeze of rewards is possible if efficientsupply 0
- 51776 - [SC - Low] streak system breaks despite timely user action due to delayed supra oracle callback
- 49915 - [SC - Low] misleading event emission in createwhitelistrestrictions function in restrictionsfactory contract
- 50436 - [SC - Low] votetoslashvalidator prevents malicious inactive validators to be slashed
- 50415 - [SC - Low] getmaxnumberoftokens returns wrong value when arctokens are withdrawn
- 50402 - [SC - Low] single rate assumption ignores checkpoints in slashed case
Insight
- 53071 - [SC - Insight] okxhelper function incompatible with the uniswap v3 swap to with permit selector
- 52248 - [SC - Insight] lack of initialization check in staking allows users to stake without reward token configured causing permanent loss of yield
- 52221 - [SC - Insight] hardcoded supra subscription wallet can freeze spin
- 52837 - [SC - Insight] gas heavy repeated binary search increases reward calculation gas costs
- 51083 - [SC - Insight] claimall only loops over active reward tokens and ignores historical tokens
- 52960 - [SC - Insight] incosistent withdrawable amount calculations
- 50393 - [SC - Insight] unused admin state variable increases deployment and storage costs
- 50392 - [SC - Insight] phantom commission burn
- 52468 - [SC - Insight] dos in batch yield distribution due to cross batch state inconsistency
- 49768 - [SC - Insight] missing input validation in raffle editprize breaks functionality
- 51288 - [SC - Insight] validators commission can be permanently lost
- 50380 - [SC - Insight] redundant use of allowedimplementations mapping in factory contracts createtoken and createwhitelistrestrictions in arctokenfactory and restrictionsfactory respectively
- 52137 - [SC - Insight] silent override of non global module implementation causes stored state and event log inconsistency
- 49738 - [SC - Insight] active users in prize pool loose invested raffle tickets when raffle removeprize is called
- 51712 - [SC - Insight] yield distribution will revert if global module doesn t implement iyieldrestrictions
- 52937 - [SC - Insight] redundant raffle ticket balance check
- 50691 - [SC - Insight] no validator limit can lead to dos
- 49726 - [SC - Insight] there is a redundant zero address check in the validatorfacet sol that is obsolete and could never be true
- 51707 - [SC - Insight] gas inefficiency due to redundant validatevalidatorexists modifier in requestcommissionclaim
- 51001 - [SC - Insight] inaccurate share calculation in emitted event for non bridge deposits
- 50677 - [SC - Insight] redundant code in dexaggregatorwrapperwithpredicateproxy impairs readability and potentially increases gas costs
- 51493 - [SC - Insight] misleading view function documentation
- 50675 - [SC - Insight] re entrant eth refund can emit mismatched shares in deposit event
- 50973 - [SC - Insight] incorrect parameter type in setjackpotprobabilities
- 51920 - [SC - Insight] unnecessary second hand of if check in calculaterewardswithcheckpointsview
- 51918 - [SC - Insight] redundant zero address checks for router address
- 50312 - [SC - Insight] validator can steal user rewards due to a lack of cooldown when validator increases commission
- 50632 - [SC - Insight] critical timestamp parsing bug in getyear of datetime contract
- 50949 - [SC - Insight] no check if raffle actually has enough funds
- 52918 - [SC - Insight] redundant check for allwinnersdrawn error
- 50284 - [SC - Insight] incorrect erc7201 storage implementation in core factory contracts
- 49671 - [SC - Insight] wrong emission in stake
- 49668 - [SC - Insight] validator status function emit misleading event
- 49639 - [SC - Insight] gas inefficiency in loop storage reads processmaturedcooldowns
- 49626 - [SC - Insight] modulo bias in winner selection in raffle
- 51651 - [SC - Insight] redundant array access in removestakerfromvalidator
- 51171 - [SC - Insight] redundant storage reads and unnecessary checks in reward rate checkpoint logic lead to inefficient gas usage
- 50212 - [SC - Insight] validators without staked funds can control slashing decisions leading to protocol insolvency
- 51159 - [SC - Insight] high gas iterative date calculations in datetime sol
- 50887 - [SC - Insight] arcotokenpurchase purchasemade event mislabels payment amount as pricepaid instead of unit price
- 50187 - [SC - Insight] yieldblacklistrestrictions uses slot 0 instead of unstructured storage risking slot collision
- 50168 - [SC - Insight] unused and duplicated functions should be removed from rewardsfacet and stakingfacet
- 50060 - [SC - Insight] scattered module processing pattern in arctoken update function
- 50506 - [SC - Insight] stakingfacet missing event emission on any unstaking operations
- 51100 - [SC - Insight] gas inefficiency in prize removal logic
- 50027 - [SC - Insight] missing validation of okx swap output token in function okxhelper
- 52303 - [SC - Insight] incorrect yield distribution event emission
- 51814 - [SC - Insight] checkpoint cumulativeindex returned in the getrewardratecheckpoint function will be zero
- 49954 - [SC - Insight] raffle editprizes lacks logic to make prizes immutable once winner selection starts or users join breaking user trust
- 50470 - [SC - Insight] inefficient design in distributeyieldwithlimit arctoken creates unnecessary gas consumption
- 49932 - [SC - Insight] there are five separate but similar implementations of a binary search that can be condensed into one function
- 50461 - [SC - Insight] incorrect deposit event receiver logged in bridge functions of dexaggregatorwrapperwithpredicateproxy sol
- 49919 - [SC - Insight] unstake function does not unstake all as mentioned in the natspec
- 49893 - [SC - Insight] raffle sol implementation logic allows direct plume transfers but has no withdraw locking funds permanently
- 49876 - [SC - Insight] lack of refund on admin canceled spin requests leads to permanent loss of funds
- 49868 - [SC - Insight] raffle sol does not enforce prize endtimestamp allowing user and admin interactions with expired prizes
- 49835 - [SC - Insight] dex aggregator unused eth loss
- 49800 - [SC - Insight] yield distribution could encounter an unexpected revert
- 49798 - [SC - Insight] invalid holder set initialization bypasses modular restrictions corrupting yield distribution
Reports by Type
Smart Contract
- 53077 - [SC - High] permanent fund lock due to flawed remainder logic in distributeyield
- 53072 - [SC - High] ceil vs floor rounding mismatch causes systematic underpayment and unclaimed yield leakage
- 53071 - [SC - Insight] okxhelper function incompatible with the uniswap v3 swap to with permit selector
- 53070 - [SC - High] validator commission update during max allowed commission change causes incorrect reward calculations
- 53069 - [SC - Low] dynamic cooldown interval changes cause unexpected fund lockup extensions
- 53063 - [SC - Low] maxvalidatorpercentage can be used to dos protocol staking
- 53061 - [SC - High] asymmetric rounding in commission ceil for users floor for validators enables per segment rounding loss validators can amplify via frequent commission checkpoints
- 53059 - [SC - Low] reward rate checkpoints are used but are never set
- 53056 - [SC - Low] native withdraw to msg sender only non payable contract stakers cannot withdraw permanent funds lock
- 53051 - [SC - High] unconsented stakeonbehalf enables third party gas griefing dos by bloating uservalidators breaking withdraw claimall
- 53048 - [SC - Medium] approval logic can break on non standard erc 20s usdt style and leave allowances loose
- 53047 - [SC - High] the jackpot eligibility check uses stale storage data instead of the freshly calculated streak
- 53043 - [SC - High] handlerandomness doesn t properly account for current streak which could result in the user spinning losing a jackpot
- 53039 - [SC - High] rewards and commissions accrued in the interval before a slash might be lost
- 53038 - [SC - Low] distributeyield can be frontrun to sandwich rewards we can force ourselves to be the last holder and get unfairly big bonuses
- 53037 - [SC - Critical] commission changes can retroactively affect user rewards
- 53035 - [SC - Medium] share lock applied to wrapper instead of end user breaks transfers or bypasses lock
- 53034 - [SC - High] arctokenfactory doesn t properly handle role management which allows users to arbitrary upgrade their arctoken s implementation
- 53028 - [SC - High] there is an asymmetric rounding issue that is can cause a theft of unclaimed yield in reward or commission accounting
- 53025 - [SC - High] commission on removed tokens is unclaimable
- 53022 - [SC - Critical] funds are not properly refunded to user which calls for swap on the dex aggregator
- 53021 - [SC - Medium] deposit and bridge workflow bricked by immediate share lock users cannot bridge immediately after deposit
- 53020 - [SC - High] there are functions which when inevitably used could result in wrongly accruing yield for inactive validators which can make the protocol insolvent
- 53018 - [SC - High] owed rewards could be lost for some users for periods before slashing time due to incorrect logic
- 53016 - [SC - High] arctokenpurchase doesn t allow rwa token owners to recover accrued yield from stored arctokens waiting for sale
- 53015 - [SC - Low] raffle does not invalidate used tickets breaking fairness
- 53011 - [SC - Critical] uncleaned partial approval consumption in dex aggregator integration leads to permanent dos
- 53001 - [SC - High] yield tokens become stuck in arctokenpurchase contract when distributing yield during active sales
- 52998 - [SC - Low] minor delays from oracle can unfairly reset users streak
- 52896 - [SC - Low] pause gate is present but no way to pause
- 52891 - [SC - Low] staking and unstaking immediately an amount little less than the original staked amount leaves dust stake amounts in the system
- 52996 - [SC - High] users can claim rewards for newly added reward tokens even when the validator they staked for was inactive during some time interval
- 52995 - [SC - High] validators lose access to historical reward tokens when tokens are removed
- 52589 - [SC - Low] in distribute yield function if there are no legitimate users i e no restricted users the funds will remain stuck
- 52990 - [SC - Low] uint8 truncation and missing cap on week index can return wrong zero jackpot amounts low contract fails to deliver promised returns
- 52890 - [SC - Low] no recipient yield distribution locks yield tokens on arctoken efftotal 0
- 52588 - [SC - High] retroactive reward accrual for newly added tokens when validator was inactive
- 52988 - [SC - Medium] deposit function dos
- 52290 - [SC - Medium] deposit function in tellerwithmultiassetsupportpredicateproxy is completely broken due to wrong share lock
- 52986 - [SC - High] jackpot check uses previous streakcount instead of current computed streak denying jackpot on first eligible day
- 52576 - [SC - High] flaw in raffle determinereward in jackpot prize calculation after week 12
- 52889 - [SC - High] inactive validators accrue rewards for new tokens
- 52286 - [SC - High] off by one error in jackpot eligibility check leads to denial of legitimate rewards
- 52573 - [SC - High] unconsented stakeonbehalf enables unbounded gas consumption via uservalidators growth causing dos at scale in claimall withdraw
- 52983 - [SC - High] validator will loose commission for the tokens which are removed from the reward tokens but they still have commission left to be claimed
- 52870 - [SC - Low] cooldown extension logic may lead to locked funds
- 52285 - [SC - High] incorrect dust handling in yield distribution leads to permanent fund lock
- 52572 - [SC - High] a legitimate arc token holder can be denied his yield
- 52865 - [SC - High] inconsistency in how stake cooldown is handled due to off by one error
- 51999 - [SC - High] logical flaw in validator reactivation and addrewardtoken allows claiming rewards for validators in inactive periods
- 52982 - [SC - Medium] non standard erc20 approvals usdt like cause repeat call failures after partial fills
- 52278 - [SC - High] incorrect streak check in jackpot eligibility leads to unfair reward denial
- 51994 - [SC - High] permanent loss of validator commission upon reward token removal
- 52560 - [SC - High] incorrect current streak used when calculating whether the jackpot should be awarded or not
- 52277 - [SC - Low] race condition in streak calculation leads to unfair streak reset for users spinning near utc day change
- 52849 - [SC - High] claimers who claim after slash inactive updaterewardpertokenforvalidator which advances validatorlastupdatetimes to be more than slashtimestamp will lose rewards for a segment
- 51771 - [SC - Low] unsafe downcast of uint256 to uint8 will lead to silent overflow
- 51992 - [SC - High] dust accumulation in arctoken during yield distribution
- 52254 - [SC - High] arctoken theft beyond unclaimed yield during distribution
- 51989 - [SC - Low] event restrictionscreated always emits msg sender as owner
- 52847 - [SC - High] no function to recover the remained yield by distributeyieldwithlimit
- 51754 - [SC - High] double yield distribution via token transfers between distributeyieldwithlimit calls
- 52527 - [SC - High] the validator admin might claim less commission token when validatorfacet requestcommissionclaim is called
- 52980 - [SC - Critical] partial fills strand source tokens in the wrapper and leave dangerous residual allowances
- 52248 - [SC - Insight] lack of initialization check in staking allows users to stake without reward token configured causing permanent loss of yield
- 51596 - [SC - Low] unsafe uint256 to uint8 downcast causes integer overflow leading to unauthorized jackpot payouts after week 255
- 52845 - [SC - High] distributeyieldwithlimit lacks snapshot between batches allowing state changes to break distribution and lock yield
- 52241 - [SC - Low] unexposed pauseable functionality
- 51746 - [SC - Low] depositandbridge function of tellerwithmultiassetsupportpredicateproxy sol can not be paused
- 51988 - [SC - Medium] plumerewardlogic calculaterewardswithcheckpointsview lacking of checking if the validator is inactive but not slashed
- 52519 - [SC - Low] missing eligibility check before fund transfer in distributeyield leads to permanent loss of yield tokens
- 51391 - [SC - Low] enabletoken function overwrites amountsold to zero causing permanent loss of sales history
- 52221 - [SC - Insight] hardcoded supra subscription wallet can freeze spin
- 52843 - [SC - Low] the zero address cannot be whitelisted which means during restrictions minting and burning cannot work
- 51589 - [SC - High] tokencreator retains upgrade rights fix remains insufficient finding 01 immunefi report
- 52979 - [SC - Low] whitelistrestrictions unintentionally disables mint and burn when transfers are restricted
- 52517 - [SC - High] missing point in time snapshot in batched yield distribution enables double claims and permanent fund lock
- 52218 - [SC - High] creator retains default admin role allowing bypass of upgrade restrictions
- 52841 - [SC - Medium] token admin can dos admin to not let admin change purchase token
- 52976 - [SC - Low] turning on transfer restriction permanently blocks minting and burning
- 51369 - [SC - High] unbounded iteration gas dos in validatetokenforclaim
- 51987 - [SC - High] validators will be able to steal more commission from users that isn t the commission to be charged
- 52203 - [SC - Medium] griefing attack on arctokenpurchase setpurchasetoken function via front running
- 52837 - [SC - Insight] gas heavy repeated binary search increases reward calculation gas costs
- 51090 - [SC - High] malicious user can steal yields when arctoken distributeyieldwithlimit is used
- 51567 - [SC - Low] contract cannot be paused missing public pause and unpause functions
- 52974 - [SC - Medium] when the approval to the okxapprover is not fully spent the deposit function will be blocked
- 51352 - [SC - Critical] user will lose the unspent amount when executing partial swaps via 1inch
- 51083 - [SC - Insight] claimall only loops over active reward tokens and ignores historical tokens
- 52833 - [SC - High] bypass the fix of immunefi audit imm crit 01 token creator can upgrade arctoken implementation
- 52202 - [SC - Low] failure to invalidate winning tickets allows multiple wins from single entry
- 51980 - [SC - Low] unstake cooldown period is mistakenly reset on each claim resulting in temporary frozen funds
- 51558 - [SC - High] arctoken holder can receive yield twice from distributeyieldwithlimit
- 50796 - [SC - High] jackpot eligibility uses stale streak
- 52500 - [SC - High] missing commission checkpoint initialization leads to retroactive commission theft of user rewards
- 52198 - [SC - High] balance manipulation between batches leading to inflated payout and dos
- 51979 - [SC - Low] getaccruedcommission returns outdated accrued commission
- 51070 - [SC - Low] winning raffle ticket can be re used to maintain unfair advantage over other players in raffle
- 52499 - [SC - High] arctoken factory s admin cannot upgrade an arctoken
- 50784 - [SC - High] any arc token creator can upgrade the implementation
- 52964 - [SC - High] if a new reward token is added during a the period a validator is inactive the validator will still earn rewards commission for some of the duration in which they were inactive
- 52186 - [SC - Low] incorrect reward calculation for slashed validators due to single segment time handling
- 51970 - [SC - Low] spin streak computation relies on oracle callback time any third party delay can reset the user s streak and block jackpot eligibility
- 51324 - [SC - High] rounding in commission accounting burns delegator rewards
- 52803 - [SC - High] canrecoverfromcooldown is inconsistent when slash and cooldown maturity occur in the same block
- 52489 - [SC - Low] when users perform unstake operations in batches it may cause some funds to be frozen for an additional period of time
- 52961 - [SC - High] theft of yield from the distributor
- 50783 - [SC - Low] validator percentage cap does not work properly
- 51320 - [SC - Low] malicious teller parameter allow event data manipulation
- 51966 - [SC - Low] totalamountclaimable reverts instead of returning the claimable reward for historical tokens
- 50399 - [SC - Low] broken access control in particular contract functions due lack of pause unpause functionality
- 51547 - [SC - Medium] approval race condition with safeapprove leads to transaction reverts
- 52960 - [SC - Insight] incosistent withdrawable amount calculations
- 52798 - [SC - High] integer division remainder loss in batched yield distribution causes permanent fund lock
- 51961 - [SC - High] attackers can deny commission rewards to validators by repeatedly calling forcesettlevalidatorcommission
- 50745 - [SC - Low] single cooldown entry design causes timer reset on multiple unstakes leading to extended lock periods
- 51530 - [SC - High] validators can not claim pending accrued commission when reward tokens have been removed from the isrewardtoken mapping
- 50393 - [SC - Insight] unused admin state variable increases deployment and storage costs
- 52796 - [SC - Low] whitelist restriction in arctoken blocks all minting and burning
- 52956 - [SC - High] state inconsistency in batched yield distribution leads to direct theft of user funds and protocol insolvency
- 49787 - [SC - High] batched yield distribution doesn t account for transfers purchases between batches
- 52178 - [SC - Critical] user will lose the unspent amount when executing partial swaps via okxrouter
- 51296 - [SC - Low] arctokenpurchase withdrawal breaks view functions
- 51051 - [SC - High] inactive validator reward accrual bypass
- 50392 - [SC - Insight] phantom commission burn
- 52955 - [SC - High] a commission rate checkpoint is not created when adding a validator despite the commission rate being set leading to loss of validator commission
- 52468 - [SC - Insight] dos in batch yield distribution due to cross batch state inconsistency
- 52165 - [SC - High] user can t claim reward erc20 tokens since rewards transfer will revert
- 51951 - [SC - Low] a global blocking check in claimprize prevents individual winner claims until all winners are drawn
- 51728 - [SC - High] users can claim rewards for inactive validator periods due to incorrect checkpoint accrual
- 52794 - [SC - Low] remainingforsale not updated after withdrawunsoldarctokens will cause following buy revert
- 52948 - [SC - Low] jackpot reward rejected at exact threshold
- 50735 - [SC - High] some yield tokens will be stuck in contract due to incorrect lastprocessedindex calculation
- 51525 - [SC - Low] unfair yield distribution to last holder due to flawed dust handling
- 49768 - [SC - Insight] missing input validation in raffle editprize breaks functionality
- 51288 - [SC - Insight] validators commission can be permanently lost
- 50380 - [SC - Insight] redundant use of allowedimplementations mapping in factory contracts createtoken and createwhitelistrestrictions in arctokenfactory and restrictionsfactory respectively
- 51946 - [SC - High] commission claims fail for removed reward tokens
- 51043 - [SC - Medium] core deposit and depositandbridge functionality in tellerwithmultiassetsupportpredicateproxy is non functional due to flawed sharelockperiod logic
- 52137 - [SC - Insight] silent override of non global module implementation causes stored state and event log inconsistency
- 51519 - [SC - Low] unstake does not validate users remaing stake
- 52464 - [SC - High] commission rounding mismatch under payment bug
- 50721 - [SC - Low] winners cannot claim prizes until all winners have been drawn in raffle claimprize
- 51713 - [SC - Low] missing minimum stake validation in unstake operations
- 52787 - [SC - High] batched yield distribution rounding in arctoken permanently freezes unclaimed funds and misreports payouts
- 49738 - [SC - Insight] active users in prize pool loose invested raffle tickets when raffle removeprize is called
- 51041 - [SC - High] streak count misuse in jackpot eligibility allows theft of user funds
- 52944 - [SC - High] the requestcommisionclaim function can only claim commission on tokens that are currently reward tokens
- 51286 - [SC - Low] event restrictionscreated uses wrong owner
- 50713 - [SC - High] deployer s default admin role enables self grant of upgrader role bypassing implementation whitelist
- 51510 - [SC - Low] bypass of maxvalidatorpercentage allows a validator to exceed the decentralisation cap
- 51941 - [SC - High] token creator can revoke factory s upgrade capability permanently blocking upgrades
- 51712 - [SC - Insight] yield distribution will revert if global module doesn t implement iyieldrestrictions
- 49732 - [SC - Medium] malicious token admin can permanently block setpurchasetoken
- 51034 - [SC - Low] sales information is lost when enabling token
- 52780 - [SC - High] timestamp manipulation in forcesettlevalidatorcommission leads to permanent loss of staker rewards
- 52129 - [SC - Low] previewyielddistribution reverts instead of returning zero when no tokens are in circulation
- 50694 - [SC - Low] spins occuring close to midnight lead to users streaks being unfairly broken due to vrf callback delay
- 51929 - [SC - Low] deactivating istransferallowed indirectly doses minting burning functionality
- 50350 - [SC - High] stakingfacet stakeonbehalf allows to prevent withdraws
- 49731 - [SC - High] theft on re added tokens
- 51502 - [SC - Low] enabling transfer restrictions permanently blocks minting and burning
- 52937 - [SC - Insight] redundant raffle ticket balance check
- 50691 - [SC - Insight] no validator limit can lead to dos
- 49726 - [SC - Insight] there is a redundant zero address check in the validatorfacet sol that is obsolete and could never be true
- 51707 - [SC - Insight] gas inefficiency due to redundant validatevalidatorexists modifier in requestcommissionclaim
- 51283 - [SC - Critical] permanent freeze of user token due to unhandled partial fill refunds for swap via 1inch in dexaggregatorwrapperwithpredicateproxy
- 52770 - [SC - High] unbounded gas consumption via stakeonbehalf manipulation
- 51001 - [SC - Insight] inaccurate share calculation in emitted event for non bridge deposits
- 50677 - [SC - Insight] redundant code in dexaggregatorwrapperwithpredicateproxy impairs readability and potentially increases gas costs
- 51276 - [SC - Low] arctokenpurchase re enabling active token sales causes accounting corruption and token loss
- 51493 - [SC - Insight] misleading view function documentation
- 50977 - [SC - Low] tellerwithmultiassetsupportpredicateproxy contract cannot be emergency paused
- 51684 - [SC - Medium] unbounded gas consumption in removestakerfromallvalidators leads to denial of service preventing users with large validator counts from removing associations and potentially lock
- 52750 - [SC - Low] percentage limit bypass via unstaking from other validators
- 52931 - [SC - High] validators can not claim their commissions after the reward token removal
- 50675 - [SC - Insight] re entrant eth refund can emit mismatched shares in deposit event
- 50343 - [SC - Low] cooldown reset vulnerability
- 51479 - [SC - High] inaccurate reward calculation post validator slashing due to premature timestamp update on token removal
- 50340 - [SC - Medium] any arctoken admin can block the setting update of the purchase token indefinitely
- 52449 - [SC - High] broken streaks still pass jackpot eligibility in spin contract
- 51476 - [SC - Medium] validators can t claim their accrued commission if they are made inactive
- 49710 - [SC - High] cross batch state manipulation in yield distribution allows double dipping of yield funds
- 52113 - [SC - Low] stakingfacet unstake uint16 validatorid uint256 amount can be abused to bypass minstakeamount
- 50973 - [SC - Insight] incorrect parameter type in setjackpotprobabilities
- 51920 - [SC - Insight] unnecessary second hand of if check in calculaterewardswithcheckpointsview
- 52446 - [SC - Low] withdrawing unsold tokens desynchronizes sale accounting
- 51457 - [SC - Low] getaccruedcommission reverts when token was removed instead of returning the accrued commission
- 52925 - [SC - Medium] usdt like approval hygiene can block subsequent operations after partial fill leaves non zero allowance
- 52104 - [SC - High] removed reward tokens block validator commission claims
- 51918 - [SC - Insight] redundant zero address checks for router address
- 52732 - [SC - Medium] permanent dos of purchase token change
- 50312 - [SC - Insight] validator can steal user rewards due to a lack of cooldown when validator increases commission
- 51456 - [SC - High] token creator can revoke the upgrader role from the factory in order to avoid upgrades
- 50632 - [SC - Insight] critical timestamp parsing bug in getyear of datetime contract
- 50951 - [SC - High] inconsistent streak count usage between jackpot and raffle ticket calculations
- 52439 - [SC - High] dust accumulation in batched yield payouts leaves tokens stranded
- 49705 - [SC - Medium] two vectors for unbounded gas consumption due to the normal raffle operations
- 50949 - [SC - Insight] no check if raffle actually has enough funds
- 51455 - [SC - Low] inflated earned ui rewards when validator stake is zero due to missing totalstaked guard in view logic
- 52436 - [SC - Low] getaccruedcommission could return an inaccurate value
- 52923 - [SC - Critical] partial fill traps source token residual inside the wrapper and leaves unsafe residual allowance
- 51666 - [SC - Medium] inactive validators blocked from claiming accrued commission
- 49700 - [SC - High] validator commission can be blocked
- 52719 - [SC - Medium] inactive validators blocked from claiming commissions despite passed timelock
- 51218 - [SC - High] oracle callback timing vulnerability causes jackpot prize loss
- 51912 - [SC - High] mismatched rounding rules in reward logic library results in two fold loss of earnings
- 51658 - [SC - High] yield distribution in batches let the same tokens collect rewards in multiple batches stealing yield from other users
- 52084 - [SC - High] unstaking before reward token removal leads to incorrect reward accrual on re addition
- 52711 - [SC - High] in validatorfacet validator cannot claims commissions of removed tokens
- 51452 - [SC - High] stakeonbehalf function enables out of gas dos
- 49698 - [SC - Low] coordinated validator attack delays slashing and enables commission theft
- 52075 - [SC - Medium] arctokenpurchase contract is a token holder and may be yield recipient
- 52918 - [SC - Insight] redundant check for allwinnersdrawn error
- 51910 - [SC - Low] inconsistent yield token transfer logic causes permanent loss of yield in distributeyield
- 51451 - [SC - Low] token freezing via whitelist restriction bypass
- 51201 - [SC - Low] contracts without payable entry points cannot withdraw nor claim rewards
- 50937 - [SC - Medium] non zero approve pattern causes permanent freeze of token deposits e g usdt due to erc20 incompatibility
- 52710 - [SC - Low] mint burn are blocked when whitelist restrictions are enabled
- 51414 - [SC - High] attacker can drain yield by transferring tokens to other address in yield batch distributions
- 50284 - [SC - Insight] incorrect erc7201 storage implementation in core factory contracts
- 50624 - [SC - Low] there is a missing emergency pause in predicate proxy
- 52915 - [SC - Low] yield are transferred before eligibility check potentially leading to freezing of funds
- 51909 - [SC - Medium] inconsistent commission claim logic denies legitimate claims for inactive validators
- 50275 - [SC - High] eligible user loses jackpot
- 52424 - [SC - High] there is a retroactive commission miscalculation in plumerewardlogic
- 51412 - [SC - Low] token admin can withdraw the token from the purchase contract making the token balance to be less than the totalamountforsale
- 52706 - [SC - Low] multi quantity prize claims revert until all winners are drawn freezing early winners
- 49671 - [SC - Insight] wrong emission in stake
- 50252 - [SC - High] rounding excess yield tokens become permanently stuck when last holder is yield restricted
- 51197 - [SC - High] arc token owner can take upgrader role for themselves lockout the factory and upgrade the contract without the knowledge of the factory
- 52690 - [SC - Medium] dos of smart contracts on bridging functions
- 52422 - [SC - Low] using the current time in geteffectiverewardrateat will result in incorrect reward calculation for an entire duration of a time segment
- 50924 - [SC - High] validators are not able to claim their accrued commission when the reward token is removed
- 49668 - [SC - Insight] validator status function emit misleading event
- 51180 - [SC - Medium] function is vulnerable to gas griefing
- 52680 - [SC - High] holders length changing when distributing limit with limit could lead to case where new holders unfairly claim yield and yield is permanently frozen
- 51899 - [SC - Medium] partial distribution of yield will fail if the totalefficentive supply increases
- 49647 - [SC - Low] pausable functions are not exposed
- 52041 - [SC - Low] in arctoken attacker can reposition to last holder and capture entire yield remainder
- 50922 - [SC - Low] unstaking partially will extend the cooldown time for previously unstaked amount too
- 49639 - [SC - Insight] gas inefficiency in loop storage reads processmaturedcooldowns
- 51653 - [SC - High] permanent loss of staker rewards after slashing when validator records are cleared
- 52901 - [SC - Low] wrapped week index can mis price jackpot table after long uptime
- 50225 - [SC - Low] user can bypass minstakeamount checking
- 49626 - [SC - Insight] modulo bias in winner selection in raffle
- 51651 - [SC - Insight] redundant array access in removestakerfromvalidator
- 52409 - [SC - High] asymmetric commission rounding creates systematic accounting drift
- 51613 - [SC - Medium] yield tokens can be stuck in arctokenpurchase plumestakingrewardtreasury or other defi protocols when distributeyield is called
- 51171 - [SC - Insight] redundant storage reads and unnecessary checks in reward rate checkpoint logic lead to inefficient gas usage
- 50916 - [SC - High] token creators can bypass factory upgrade controls via wrong code implementation of default admin role in arctokenfactory sol
- 49623 - [SC - Low] unstaking allows going below minimum stake
- 50560 - [SC - High] inconsistent commission rounding traps user validator funds
- 50212 - [SC - Insight] validators without staked funds can control slashing decisions leading to protocol insolvency
- 52397 - [SC - Medium] repeated approve without zero reset can revert on nonstandard erc20s blocking deposits
- 52031 - [SC - Medium] insufficient access control in token sales management leads to permanent griefing attack
- 50914 - [SC - Low] bypass of minimum stake enforcement via partial unstake
- 49616 - [SC - High] user can steal rewards
- 50551 - [SC - Low] staked dust positions are not properly prevented
- 51162 - [SC - Low] missing pause control implementation in tellerwithmultiassetsupportpredicateproxy
- 50889 - [SC - Low] arctokenpurchase withdrawunsoldarctokens fails to reduce totalamountforsale leaving availability counters wrong
- 51887 - [SC - Medium] safeapprove will cause revert of usdt and similar erc20 token
- 52393 - [SC - Low] burns blocked by both sides whitelist with zero address exclusion when restrictions are enabled
- 51159 - [SC - Insight] high gas iterative date calculations in datetime sol
- 50195 - [SC - Low] unfair yield distribution due to remainder allocation to last holder
- 50887 - [SC - Insight] arcotokenpurchase purchasemade event mislabels payment amount as pricepaid instead of unit price
- 52390 - [SC - High] validateistoken blocks validators from claiming earned rewards from removed tokens
- 51882 - [SC - Low] unnecessary claiming restriction in raffle contract prevents winners from claiming prizes until all winners are drawn
- 52669 - [SC - Low] token minting is blocked for whitelisted addresses when transfersallowed is false
- 50527 - [SC - High] attacker can steal yield during batch distribution
- 50860 - [SC - High] logic error in jackpot eligibility check leads to systematic theft of user rewards
- 50187 - [SC - Insight] yieldblacklistrestrictions uses slot 0 instead of unstructured storage risking slot collision
- 51146 - [SC - Low] getmaxnumberoftokens returns wrong max number of tokens available to buy
- 52667 - [SC - High] commission is not added at point of adding validator hence stakers that stake before the first checkpoint would always use the current commission
- 51878 - [SC - High] timing misalignment between campaign days and calendar days allows double spinning on high probability jackpot days
- 52027 - [SC - Low] WhitelistRestrictions.sol: Mint & Burn Operations Blocked When Transfers Disabled
- 50839 - [SC - Low] last holder always gets more yield
- 50168 - [SC - Insight] unused and duplicated functions should be removed from rewardsfacet and stakingfacet
- 52649 - [SC - High] token creator can seize upgrade control bypassing factory whitelist and enabling theft of funds
- 52026 - [SC - Medium] claimall could revert because of unbounded gas consumptions
- 50822 - [SC - High] deployer can cpgrade arctoken to malicious implementation and steal all user funds
- 50167 - [SC - High] retroactive reward drain via incomplete reward debt reset
- 51863 - [SC - Low] lack of winning ticket removal in handlewinnerselection leads to unfair prize distribution and economic exploitation
- 52371 - [SC - High] distributeyieldwithlimit is vulnerable to inter batch balance and holders array mutations
- 50120 - [SC - Low] arctokens cannot be burned or minted when transfers are restricted
- 52634 - [SC - High] batch yield distribution has a mathematical flaw that enables economic manipulation
- 50519 - [SC - High] rewardsfacet reintroducing an old reward token will result in wrong accounting leading to theft of yield
- 51132 - [SC - Low] tellerwithmultiassetsupportpredicateproxy cannot be paused unpaused
- 50082 - [SC - Low] protocol lets validators operate with dust amounts making attacks risk free
- 52347 - [SC - High] improper handling of yield distribution state in distributeyieldwithlimit leads to revert freezing users yield
- 50507 - [SC - High] non atomic yield distribution may lead to theft of yield
- 51129 - [SC - Low] boringvault proxies do not support smart contract wallets
- 51860 - [SC - High] missing access control in stakeonbehalf lets anyone bloat another user s validator list leading to permanent fund lock via gas exhaustion dos
- 50060 - [SC - Insight] scattered module processing pattern in arctoken update function
- 51850 - [SC - Low] upgradetoken can not initialize an upgraded token because the data variable of upgradetoandcall is hardcoded to empty string
- 50506 - [SC - Insight] stakingfacet missing event emission on any unstaking operations
- 51124 - [SC - High] validator would loss commission fee if the rewards token are removed
- 52620 - [SC - Medium] permanently dos to arctokenpurchase contract
- 52339 - [SC - Low] loss of daily streak and jackpot eligibility due to supra generator callback delay and on callback time usage in spin sol
- 51847 - [SC - Critical] dos via dust leftover in erc 20 approvals
- 52601 - [SC - High] in spin handlerandomness jackpot eligibility uses outdated streakcount instead of updated streak
- 51122 - [SC - Low] arctokenpurchase enabletoken can reset the amountsold to 0
- 52327 - [SC - Low] unfair yield distribution due to last holder bias
- 51842 - [SC - High] unclaimed staker rewards lost when admin clears validator records without checking pending rewards
- 50040 - [SC - Low] missing pause controls eth refund flaws and miscalculated shares enable fund loss and protocol inconsistency in depositandbridge
- 52314 - [SC - Low] unsold token withdrawal causes permanent inventory mismatch
- 51836 - [SC - Low] contract cannot be paused despite inheriting pausable
- 51100 - [SC - Insight] gas inefficiency in prize removal logic
- 50493 - [SC - Low] immutable proxy implementation mapping in restrictionsfactory breaks upgrade logic
- 52312 - [SC - Low] cooldown coalescing bug unintended cooldown extension for prior unstakes
- 51816 - [SC - Low] yield distribution can be front run to steal rounding remainder as last holder
- 50027 - [SC - Insight] missing validation of okx swap output token in function okxhelper
- 52303 - [SC - Insight] incorrect yield distribution event emission
- 51814 - [SC - Insight] checkpoint cumulativeindex returned in the getrewardratecheckpoint function will be zero
- 50490 - [SC - High] user loses reward tokens during validator user relationship clearing
- 50022 - [SC - Low] missing admin pause unpause functions in tellerwithmultiassetsupportpredicateproxy contract
- 49963 - [SC - Medium] anyone can create an arctoken and block the setpurchasetoken function
- 50487 - [SC - Low] cross campaign jackpot denial due to state pollution
- 49954 - [SC - Insight] raffle editprizes lacks logic to make prizes immutable once winner selection starts or users join breaking user trust
- 51813 - [SC - High] malicious user can grief victims by staking them across many validators leading to fund freezing
- 49941 - [SC - Low] permanent freezing of yield tokens due to flawed check in distribution logic
- 51802 - [SC - Low] temporary freeze of rewards is possible if efficientsupply 0
- 50477 - [SC - High] validator loses all accrued commission when reward token is removed
- 51801 - [SC - Medium] supra callback allows for theft of gas
- 49939 - [SC - High] initial timestamp mismatch might lead to users being able to spin twice in the same day
- 50470 - [SC - Insight] inefficient design in distributeyieldwithlimit arctoken creates unnecessary gas consumption
- 49932 - [SC - Insight] there are five separate but similar implementations of a binary search that can be condensed into one function
- 51777 - [SC - Medium] denial of service on depositandbridge function for sharelockperiod is non zero
- 50461 - [SC - Insight] incorrect deposit event receiver logged in bridge functions of dexaggregatorwrapperwithpredicateproxy sol
- 49919 - [SC - Insight] unstake function does not unstake all as mentioned in the natspec
- 50450 - [SC - High] logic error in streak validation causes legitimate jackpot wins to be denied violating reward contract expectations
- 51776 - [SC - Low] streak system breaks despite timely user action due to delayed supra oracle callback
- 49915 - [SC - Low] misleading event emission in createwhitelistrestrictions function in restrictionsfactory contract
- 50436 - [SC - Low] votetoslashvalidator prevents malicious inactive validators to be slashed
- 49893 - [SC - Insight] raffle sol implementation logic allows direct plume transfers but has no withdraw locking funds permanently
- 50433 - [SC - High] validator list griefing unrestricted stakeonbehalf allows user asset freeze permanently
- 49876 - [SC - Insight] lack of refund on admin canceled spin requests leads to permanent loss of funds
- 50428 - [SC - Medium] reverting on callback increases chances of winning
- 49868 - [SC - Insight] raffle sol does not enforce prize endtimestamp allowing user and admin interactions with expired prizes
- 50425 - [SC - High] active non slashed validators cannot claim rewards when a reward token is disabled
- 49863 - [SC - Critical] dex aggregator erc20 token theft
- 50415 - [SC - Low] getmaxnumberoftokens returns wrong value when arctokens are withdrawn
- 49854 - [SC - Critical] dex aggregator partial fill token loss
- 49835 - [SC - Insight] dex aggregator unused eth loss
- 50412 - [SC - High] illegitimate reward claim after unstake due to overlapping reward rate checkpoints
- 50409 - [SC - High] validator will lose comission
- 49817 - [SC - Medium] inactive validators are prevented to claim to eligible commission rewards
- 49800 - [SC - Insight] yield distribution could encounter an unexpected revert
- 49798 - [SC - Insight] invalid holder set initialization bypasses modular restrictions corrupting yield distribution
- 50402 - [SC - Low] single rate assumption ignores checkpoints in slashed case
- 49787 - [SC - High] batched yield distribution doesn t account for transfers purchases between batches