Immunefi Audit CompetitionsPuffer Finance
Reports by Severity
High
Medium
- 28613 - [SC - Medium] User will lose funds
- 28689 - [SC - Medium] incorrect lidoLockedETH value can block full re...
- 28921 - [SC - Medium] Possibly protocol insolvency during a LIDO slas...
- 29006 - [SC - Medium] Lack of Success check of the Timelock executeT...
- 29054 - [SC - Medium] Lido discounted withdrawals are not accounted for
- 29060 - [SC - Medium] initiateETHWithdrawalsFromLido decreases totalA...
Low
- 28623 - [SC - Low] Timelock transaction that consume more then _ g...
- 28663 - [SC - Low] Deposit of stETH fails due to LIDOs - wei corno...
- 28665 - [SC - Low] Underflow risk in receive function due to discr...
- 28687 - [SC - Low] Timelocks executeTransaction incorrectly delete...
- 28777 - [SC - Low] pufETH/src/Timelock.sol::executeTransaction() - This bug makes it possible to unexpectedly execute a timelocked queued transaction TWICE, accidentally/mistakenly.
- 28789 - [SC - Low] Return value of call is not checked causing fai...
- 28792 - [SC - Low] Return value of low level isnt checked executio...
- 28796 - [SC - Low] The PufferVaultgetPendingLidoETHAmount will ret...
- 28946 - [SC - Low] The assets accounting of the vault can become o...
- 28971 - [SC - Low] Double spending or double execution of transact...
- 29015 - [SC - Low] Boolean return value of addresscall function no...
- 29067 - [SC - Low] Puffer Finance Missing Verification of Externa...
- 29116 - [SC - Low] Using deposit results in more shares for the sa...
Insight
- 28612 - [SC - Insight] EigenLayers share rate can be massively inflate...
- 28625 - [SC - Insight] Gas griefing is possible on external call
- 28629 - [SC - Insight] Missing restricted modifier on claimWithdrawalF...
- 28630 - [SC - Insight] Improper Validation for Partial Filling of INCH...
- 28632 - [SC - Insight] Setting delay at MINIMUM_DELAY in timelock fails
- 28645 - [SC - Insight] Attacker Prevents All Users From Withdrawing Fu...
- 28646 - [SC - Insight] Resubmission with Pause Bypass Potential Exploi...
- 28650 - [SC - Insight] Protocol Insolvency due to the over inflated ca...
- 28656 - [SC - Insight] Blocking redeemwithdraw from vault
- 28660 - [SC - Insight] pufETH/src/Timelock::_setDelay() - L256: State constant MINIMUM_DELAY is incorrectly treated as an invalid minimum delay value, as can be seen here where newDelay <= MINIMUM_DELAY is used instead of newDelay < MINIMUM_DELAY.
- 28688 - [SC - Insight] Unhandled Failure of _executeTransaction Call i...
- 28695 - [SC - Insight] pufETH/src/Timelock::executeTransaction() - L213: The timelock expiry check incorrectly allows for transaction execution AT the final/last block of the timelocked delay represented by lockedUntil.
- 28698 - [SC - Insight] User can frontrun claim transaction to make cla...
- 28702 - [SC - Insight] Malicious users can frontrun permits to DoS swaps
- 28729 - [SC - Insight] MINIMUM_DELAY uses incorrect value of days ins...
- 28732 - [SC - Insight] External Call from Eigen Layer can fail silentl...
- 28773 - [SC - Insight] The function claimWithdrawalFromEigenLayer can ...
- 28775 - [SC - Insight] pufETH/src/Timelock.sol::executeTransaction() - This bug makes it possible to unexpectedly execute a timelocked queued transaction TWICE, either accidentally, or intentionally.
- 28779 - [SC - Insight] Missing sender address check in receive may lea...
- 28813 - [SC - Insight] PufferVaultclaimWithdrawalFromLido according to...
- 28827 - [SC - Insight] Multi requestid claims can trigger DOS
- 28833 - [SC - Insight] Missing slippage protection in functions deposi...
- 28852 - [SC - Insight] Reverting permit transactions caught in the cat...
- 28934 - [SC - Insight] TimelockcancelTransaction does not check asser...
- 28942 - [SC - Insight] Self Destruction of inchRouter can lead to loss...
- 28947 - [SC - Insight] Info
- 28964 - [SC - Insight] Claiming withdrawals from Lido can lead to unbo...
- 28991 - [SC - Insight] Contract uint delay variable cannot be set to i...
- 29017 - [SC - Insight] Timelock is not capable of performing payable t...
- 29073 - [SC - Insight] excuteTransaction in timelock contract will una...
- 29080 - [SC - Insight] Uninitialized uups upgradeable can lead to loss...
- 29081 - [SC - Insight] No constructor should be used to set in upgrade...
- 29082 - [SC - Insight] Restricted modifier should not be used with int...
- 29099 - [SC - Insight] Actual amount of stETH deposited is less than t...
- 29110 - [SC - Insight] Insecure Token Allowance Management in PufferDe...
- 29111 - [SC - Insight] Silent Failure of ERC Permit Calls in PufferDep...
Reports by Type
Smart Contract
- 28612 - [SC - Insight] EigenLayers share rate can be massively inflate...
- 28613 - [SC - Medium] User will lose funds
- 28623 - [SC - Low] Timelock transaction that consume more then _ g...
- 28625 - [SC - Insight] Gas griefing is possible on external call
- 28629 - [SC - Insight] Missing restricted modifier on claimWithdrawalF...
- 28630 - [SC - Insight] Improper Validation for Partial Filling of INCH...
- 28632 - [SC - Insight] Setting delay at MINIMUM_DELAY in timelock fails
- 28645 - [SC - Insight] Attacker Prevents All Users From Withdrawing Fu...
- 28646 - [SC - Insight] Resubmission with Pause Bypass Potential Exploi...
- 28650 - [SC - Insight] Protocol Insolvency due to the over inflated ca...
- 28656 - [SC - Insight] Blocking redeemwithdraw from vault
- 28660 - [SC - Insight] pufETH/src/Timelock::_setDelay() - L256: State constant MINIMUM_DELAY is incorrectly treated as an invalid minimum delay value, as can be seen here where newDelay <= MINIMUM_DELAY is used instead of newDelay < MINIMUM_DELAY.
- 28663 - [SC - Low] Deposit of stETH fails due to LIDOs - wei corno...
- 28665 - [SC - Low] Underflow risk in receive function due to discr...
- 28687 - [SC - Low] Timelocks executeTransaction incorrectly delete...
- 28688 - [SC - Insight] Unhandled Failure of _executeTransaction Call i...
- 28689 - [SC - Medium] incorrect lidoLockedETH value can block full re...
- 28695 - [SC - Insight] pufETH/src/Timelock::executeTransaction() - L213: The timelock expiry check incorrectly allows for transaction execution AT the final/last block of the timelocked delay represented by lockedUntil.
- 28698 - [SC - Insight] User can frontrun claim transaction to make cla...
- 28702 - [SC - Insight] Malicious users can frontrun permits to DoS swaps
- 28729 - [SC - Insight] MINIMUM_DELAY uses incorrect value of days ins...
- 28732 - [SC - Insight] External Call from Eigen Layer can fail silentl...
- 28773 - [SC - Insight] The function claimWithdrawalFromEigenLayer can ...
- 28775 - [SC - Insight] pufETH/src/Timelock.sol::executeTransaction() - This bug makes it possible to unexpectedly execute a timelocked queued transaction TWICE, either accidentally, or intentionally.
- 28777 - [SC - Low] pufETH/src/Timelock.sol::executeTransaction() - This bug makes it possible to unexpectedly execute a timelocked queued transaction TWICE, accidentally/mistakenly.
- 28779 - [SC - Insight] Missing sender address check in receive may lea...
- 28788 - [SC - Critical] Slash during a withdrawal from EigenLayer will ...
- 28789 - [SC - Low] Return value of call is not checked causing fai...
- 28792 - [SC - Low] Return value of low level isnt checked executio...
- 28796 - [SC - Low] The PufferVaultgetPendingLidoETHAmount will ret...
- 28813 - [SC - Insight] PufferVaultclaimWithdrawalFromLido according to...
- 28827 - [SC - Insight] Multi requestid claims can trigger DOS
- 28833 - [SC - Insight] Missing slippage protection in functions deposi...
- 28852 - [SC - Insight] Reverting permit transactions caught in the cat...
- 28921 - [SC - Medium] Possibly protocol insolvency during a LIDO slas...
- 28934 - [SC - Insight] TimelockcancelTransaction does not check asser...
- 28942 - [SC - Insight] Self Destruction of inchRouter can lead to loss...
- 28946 - [SC - Low] The assets accounting of the vault can become o...
- 28947 - [SC - Insight] Info
- 28964 - [SC - Insight] Claiming withdrawals from Lido can lead to unbo...
- 28971 - [SC - Low] Double spending or double execution of transact...
- 28991 - [SC - Insight] Contract uint delay variable cannot be set to i...
- 29006 - [SC - Medium] Lack of Success check of the Timelock executeT...
- 29015 - [SC - Low] Boolean return value of addresscall function no...
- 29017 - [SC - Insight] Timelock is not capable of performing payable t...
- 29033 - [SC - High] Queued data will be lost if Tx is unsuccessful ...
- 29054 - [SC - Medium] Lido discounted withdrawals are not accounted for
- 29060 - [SC - Medium] initiateETHWithdrawalsFromLido decreases totalA...
- 29067 - [SC - Low] Puffer Finance Missing Verification of Externa...
- 29073 - [SC - Insight] excuteTransaction in timelock contract will una...
- 29080 - [SC - Insight] Uninitialized uups upgradeable can lead to loss...
- 29081 - [SC - Insight] No constructor should be used to set in upgrade...
- 29082 - [SC - Insight] Restricted modifier should not be used with int...
- 29099 - [SC - Insight] Actual amount of stETH deposited is less than t...
- 29106 - [SC - High] Insufficient Handling of Partial Failures in Wi...
- 29110 - [SC - Insight] Insecure Token Allowance Management in PufferDe...
- 29111 - [SC - Insight] Silent Failure of ERC Permit Calls in PufferDep...
- 29116 - [SC - Low] Using deposit results in more shares for the sa...