# Puffer Finance

## Reports by Severity

[Critical](#critical) | [High](#high) | [Medium](#medium) | [Low](#low) | [Insight](#insight)

<details>

<summary>Critical</summary>

* [28788 - \[SC - Critical\] Slash during a withdrawal from EigenLayer will ...](puffer-finance/28788-sc-critical-slash-during-a-withdrawal-from-eigenlayer-will-...)

</details>

<details>

<summary>High</summary>

* [29033 - \[SC - High\] Queued data will be lost if Tx is unsuccessful ...](puffer-finance/29033-sc-high-queued-data-will-be-lost-if-tx-is-unsuccessful-...)
* [29106 - \[SC - High\] Insufficient Handling of Partial Failures in Wi...](puffer-finance/29106-sc-high-insufficient-handling-of-partial-failures-in-wi...)

</details>

<details>

<summary>Medium</summary>

* [28613 - \[SC - Medium\] User will lose funds](puffer-finance/28613-sc-medium-user-will-lose-funds)
* [28689 - \[SC - Medium\] incorrect lidoLockedETH value can block full re...](puffer-finance/28689-sc-medium-incorrect-lidolockedeth-value-can-block-full-re...)
* [28921 - \[SC - Medium\] Possibly protocol insolvency during a LIDO slas...](puffer-finance/28921-sc-medium-possibly-protocol-insolvency-during-a-lido-slas...)
* [29006 - \[SC - Medium\] Lack of Success check of the Timelock executeT...](puffer-finance/29006-sc-medium-lack-of-success-check-of-the-timelock-executet...)
* [29054 - \[SC - Medium\] Lido discounted withdrawals are not accounted for](puffer-finance/29054-sc-medium-lido-discounted-withdrawals-are-not-accounted-for)
* [29060 - \[SC - Medium\] initiateETHWithdrawalsFromLido decreases totalA...](puffer-finance/29060-sc-medium-initiateethwithdrawalsfromlido-decreases-totala...)

</details>

<details>

<summary>Low</summary>

* [28623 - \[SC - Low\] Timelock transaction that consume more then \_ g...](puffer-finance/28623-sc-low-timelock-transaction-that-consume-more-then-_-g...)
* [28663 - \[SC - Low\] Deposit of stETH fails due to LIDOs - wei corno...](puffer-finance/28663-sc-low-deposit-of-steth-fails-due-to-lidos-wei-corno...)
* [28665 - \[SC - Low\] Underflow risk in receive function due to discr...](puffer-finance/28665-sc-low-underflow-risk-in-receive-function-due-to-discr...)
* [28687 - \[SC - Low\] Timelocks executeTransaction incorrectly delete...](puffer-finance/28687-sc-low-timelocks-executetransaction-incorrectly-delete...)
* [28777 - \[SC - Low\] pufETHsrcTimelocksolexecuteTransaction - This b...](puffer-finance/28777-sc-low-pufethsrctimelocksolexecutetransaction-this-b...)
* [28789 - \[SC - Low\] Return value of call is not checked causing fai...](puffer-finance/28789-sc-low-return-value-of-call-is-not-checked-causing-fai...)
* [28792 - \[SC - Low\] Return value of low level isnt checked executio...](puffer-finance/28792-sc-low-return-value-of-low-level-isnt-checked-executio...)
* [28796 - \[SC - Low\] The PufferVaultgetPendingLidoETHAmount will ret...](puffer-finance/28796-sc-low-the-puffervaultgetpendinglidoethamount-will-ret...)
* [28946 - \[SC - Low\] The assets accounting of the vault can become o...](puffer-finance/28946-sc-low-the-assets-accounting-of-the-vault-can-become-o...)
* [28971 - \[SC - Low\] Double spending or double execution of transact...](puffer-finance/28971-sc-low-double-spending-or-double-execution-of-transact...)
* [29015 - \[SC - Low\] Boolean return value of addresscall function no...](puffer-finance/29015-sc-low-boolean-return-value-of-addresscall-function-no...)
* [29067 - \[SC - Low\] Puffer Finance Missing Verification of Externa...](puffer-finance/29067-sc-low-puffer-finance-missing-verification-of-externa...)
* [29116 - \[SC - Low\] Using deposit results in more shares for the sa...](puffer-finance/29116-sc-low-using-deposit-results-in-more-shares-for-the-sa...)

</details>

<details>

<summary>Insight</summary>

* [28612 - \[SC - Insight\] EigenLayers share rate can be massively inflate...](puffer-finance/28612-sc-insight-eigenlayers-share-rate-can-be-massively-inflate...)
* [28625 - \[SC - Insight\] Gas griefing is possible on external call](puffer-finance/28625-sc-insight-gas-griefing-is-possible-on-external-call)
* [28629 - \[SC - Insight\] Missing restricted modifier on claimWithdrawalF...](puffer-finance/28629-sc-insight-missing-restricted-modifier-on-claimwithdrawalf...)
* [28630 - \[SC - Insight\] Improper Validation for Partial Filling of INCH...](puffer-finance/28630-sc-insight-improper-validation-for-partial-filling-of-inch...)
* [28632 - \[SC - Insight\] Setting delay at MINIMUM\_DELAY in timelock fails](puffer-finance/28632-sc-insight-setting-delay-at-minimum_delay-in-timelock-fails)
* [28645 - \[SC - Insight\] Attacker Prevents All Users From Withdrawing Fu...](puffer-finance/28645-sc-insight-attacker-prevents-all-users-from-withdrawing-fu...)
* [28646 - \[SC - Insight\] Resubmission with Pause Bypass Potential Exploi...](puffer-finance/28646-sc-insight-resubmission-with-pause-bypass-potential-exploi...)
* [28650 - \[SC - Insight\] Protocol Insolvency due to the over inflated ca...](puffer-finance/28650-sc-insight-protocol-insolvency-due-to-the-over-inflated-ca...)
* [28656 - \[SC - Insight\] Blocking redeemwithdraw from vault](puffer-finance/28656-sc-insight-blocking-redeemwithdraw-from-vault)
* [28660 - \[SC - Insight\] pufETHsrcTimelock\_setDelay - L State constant M...](puffer-finance/28660-sc-insight-pufethsrctimelock_setdelay-l-state-constant-m...)
* [28688 - \[SC - Insight\] Unhandled Failure of \_executeTransaction Call i...](puffer-finance/28688-sc-insight-unhandled-failure-of-_executetransaction-call-i...)
* [28695 - \[SC - Insight\] pufETHsrcTimelockexecuteTransaction - L The tim...](puffer-finance/28695-sc-insight-pufethsrctimelockexecutetransaction-l-the-tim...)
* [28698 - \[SC - Insight\] User can frontrun claim transaction to make cla...](puffer-finance/28698-sc-insight-user-can-frontrun-claim-transaction-to-make-cla...)
* [28702 - \[SC - Insight\] Malicious users can frontrun permits to DoS swaps](puffer-finance/28702-sc-insight-malicious-users-can-frontrun-permits-to-dos-swaps)
* [28729 - \[SC - Insight\] MINIMUM\_DELAY uses incorrect value of days ins...](puffer-finance/28729-sc-insight-minimum_delay-uses-incorrect-value-of-days-ins...)
* [28732 - \[SC - Insight\] External Call from Eigen Layer can fail silentl...](puffer-finance/28732-sc-insight-external-call-from-eigen-layer-can-fail-silentl...)
* [28773 - \[SC - Insight\] The function claimWithdrawalFromEigenLayer can ...](puffer-finance/28773-sc-insight-the-function-claimwithdrawalfromeigenlayer-can-...)
* [28775 - \[SC - Insight\] pufETHsrcTimelocksolexecuteTransaction - This b...](puffer-finance/28775-sc-insight-pufethsrctimelocksolexecutetransaction-this-b...)
* [28779 - \[SC - Insight\] Missing sender address check in receive may lea...](puffer-finance/28779-sc-insight-missing-sender-address-check-in-receive-may-lea...)
* [28813 - \[SC - Insight\] PufferVaultclaimWithdrawalFromLido according to...](puffer-finance/28813-sc-insight-puffervaultclaimwithdrawalfromlido-according-to...)
* [28827 - \[SC - Insight\] Multi requestid claims can trigger DOS](puffer-finance/28827-sc-insight-multi-requestid-claims-can-trigger-dos)
* [28833 - \[SC - Insight\] Missing slippage protection in functions deposi...](puffer-finance/28833-sc-insight-missing-slippage-protection-in-functions-deposi...)
* [28852 - \[SC - Insight\] Reverting permit transactions caught in the cat...](puffer-finance/28852-sc-insight-reverting-permit-transactions-caught-in-the-cat...)
* [28934 - \[SC - Insight\] TimelockcancelTransaction does not check asser...](puffer-finance/28934-sc-insight-timelockcanceltransaction-does-not-check-asser...)
* [28942 - \[SC - Insight\] Self Destruction of inchRouter can lead to loss...](puffer-finance/28942-sc-insight-self-destruction-of-inchrouter-can-lead-to-loss...)
* [28947 - \[SC - Insight\] Info](puffer-finance/28947-sc-insight-info)
* [28964 - \[SC - Insight\] Claiming withdrawals from Lido can lead to unbo...](puffer-finance/28964-sc-insight-claiming-withdrawals-from-lido-can-lead-to-unbo...)
* [28991 - \[SC - Insight\] Contract uint delay variable cannot be set to i...](puffer-finance/28991-sc-insight-contract-uint-delay-variable-cannot-be-set-to-i...)
* [29017 - \[SC - Insight\] Timelock is not capable of performing payable t...](puffer-finance/29017-sc-insight-timelock-is-not-capable-of-performing-payable-t...)
* [29073 - \[SC - Insight\] excuteTransaction in timelock contract will una...](puffer-finance/29073-sc-insight-excutetransaction-in-timelock-contract-will-una...)
* [29080 - \[SC - Insight\] Uninitialized uups upgradeable can lead to loss...](puffer-finance/29080-sc-insight-uninitialized-uups-upgradeable-can-lead-to-loss...)
* [29081 - \[SC - Insight\] No constructor should be used to set in upgrade...](puffer-finance/29081-sc-insight-no-constructor-should-be-used-to-set-in-upgrade...)
* [29082 - \[SC - Insight\] Restricted modifier should not be used with int...](puffer-finance/29082-sc-insight-restricted-modifier-should-not-be-used-with-int...)
* [29099 - \[SC - Insight\] Actual amount of stETH deposited is less than t...](puffer-finance/29099-sc-insight-actual-amount-of-steth-deposited-is-less-than-t...)
* [29110 - \[SC - Insight\] Insecure Token Allowance Management in PufferDe...](puffer-finance/29110-sc-insight-insecure-token-allowance-management-in-pufferde...)
* [29111 - \[SC - Insight\] Silent Failure of ERC Permit Calls in PufferDep...](puffer-finance/29111-sc-insight-silent-failure-of-erc-permit-calls-in-pufferdep...)

</details>

## Reports by Type

[Smart Contract](#smart-contract)

<details>

<summary>Smart Contract</summary>

* [28612 - \[SC - Insight\] EigenLayers share rate can be massively inflate...](puffer-finance/28612-sc-insight-eigenlayers-share-rate-can-be-massively-inflate...)
* [28613 - \[SC - Medium\] User will lose funds](puffer-finance/28613-sc-medium-user-will-lose-funds)
* [28623 - \[SC - Low\] Timelock transaction that consume more then \_ g...](puffer-finance/28623-sc-low-timelock-transaction-that-consume-more-then-_-g...)
* [28625 - \[SC - Insight\] Gas griefing is possible on external call](puffer-finance/28625-sc-insight-gas-griefing-is-possible-on-external-call)
* [28629 - \[SC - Insight\] Missing restricted modifier on claimWithdrawalF...](puffer-finance/28629-sc-insight-missing-restricted-modifier-on-claimwithdrawalf...)
* [28630 - \[SC - Insight\] Improper Validation for Partial Filling of INCH...](puffer-finance/28630-sc-insight-improper-validation-for-partial-filling-of-inch...)
* [28632 - \[SC - Insight\] Setting delay at MINIMUM\_DELAY in timelock fails](puffer-finance/28632-sc-insight-setting-delay-at-minimum_delay-in-timelock-fails)
* [28645 - \[SC - Insight\] Attacker Prevents All Users From Withdrawing Fu...](puffer-finance/28645-sc-insight-attacker-prevents-all-users-from-withdrawing-fu...)
* [28646 - \[SC - Insight\] Resubmission with Pause Bypass Potential Exploi...](puffer-finance/28646-sc-insight-resubmission-with-pause-bypass-potential-exploi...)
* [28650 - \[SC - Insight\] Protocol Insolvency due to the over inflated ca...](puffer-finance/28650-sc-insight-protocol-insolvency-due-to-the-over-inflated-ca...)
* [28656 - \[SC - Insight\] Blocking redeemwithdraw from vault](puffer-finance/28656-sc-insight-blocking-redeemwithdraw-from-vault)
* [28660 - \[SC - Insight\] pufETHsrcTimelock\_setDelay - L State constant M...](puffer-finance/28660-sc-insight-pufethsrctimelock_setdelay-l-state-constant-m...)
* [28663 - \[SC - Low\] Deposit of stETH fails due to LIDOs - wei corno...](puffer-finance/28663-sc-low-deposit-of-steth-fails-due-to-lidos-wei-corno...)
* [28665 - \[SC - Low\] Underflow risk in receive function due to discr...](puffer-finance/28665-sc-low-underflow-risk-in-receive-function-due-to-discr...)
* [28687 - \[SC - Low\] Timelocks executeTransaction incorrectly delete...](puffer-finance/28687-sc-low-timelocks-executetransaction-incorrectly-delete...)
* [28688 - \[SC - Insight\] Unhandled Failure of \_executeTransaction Call i...](puffer-finance/28688-sc-insight-unhandled-failure-of-_executetransaction-call-i...)
* [28689 - \[SC - Medium\] incorrect lidoLockedETH value can block full re...](puffer-finance/28689-sc-medium-incorrect-lidolockedeth-value-can-block-full-re...)
* [28695 - \[SC - Insight\] pufETHsrcTimelockexecuteTransaction - L The tim...](puffer-finance/28695-sc-insight-pufethsrctimelockexecutetransaction-l-the-tim...)
* [28698 - \[SC - Insight\] User can frontrun claim transaction to make cla...](puffer-finance/28698-sc-insight-user-can-frontrun-claim-transaction-to-make-cla...)
* [28702 - \[SC - Insight\] Malicious users can frontrun permits to DoS swaps](puffer-finance/28702-sc-insight-malicious-users-can-frontrun-permits-to-dos-swaps)
* [28729 - \[SC - Insight\] MINIMUM\_DELAY uses incorrect value of days ins...](puffer-finance/28729-sc-insight-minimum_delay-uses-incorrect-value-of-days-ins...)
* [28732 - \[SC - Insight\] External Call from Eigen Layer can fail silentl...](puffer-finance/28732-sc-insight-external-call-from-eigen-layer-can-fail-silentl...)
* [28773 - \[SC - Insight\] The function claimWithdrawalFromEigenLayer can ...](puffer-finance/28773-sc-insight-the-function-claimwithdrawalfromeigenlayer-can-...)
* [28775 - \[SC - Insight\] pufETHsrcTimelocksolexecuteTransaction - This b...](puffer-finance/28775-sc-insight-pufethsrctimelocksolexecutetransaction-this-b...)
* [28777 - \[SC - Low\] pufETHsrcTimelocksolexecuteTransaction - This b...](puffer-finance/28777-sc-low-pufethsrctimelocksolexecutetransaction-this-b...)
* [28779 - \[SC - Insight\] Missing sender address check in receive may lea...](puffer-finance/28779-sc-insight-missing-sender-address-check-in-receive-may-lea...)
* [28788 - \[SC - Critical\] Slash during a withdrawal from EigenLayer will ...](puffer-finance/28788-sc-critical-slash-during-a-withdrawal-from-eigenlayer-will-...)
* [28789 - \[SC - Low\] Return value of call is not checked causing fai...](puffer-finance/28789-sc-low-return-value-of-call-is-not-checked-causing-fai...)
* [28792 - \[SC - Low\] Return value of low level isnt checked executio...](puffer-finance/28792-sc-low-return-value-of-low-level-isnt-checked-executio...)
* [28796 - \[SC - Low\] The PufferVaultgetPendingLidoETHAmount will ret...](puffer-finance/28796-sc-low-the-puffervaultgetpendinglidoethamount-will-ret...)
* [28813 - \[SC - Insight\] PufferVaultclaimWithdrawalFromLido according to...](puffer-finance/28813-sc-insight-puffervaultclaimwithdrawalfromlido-according-to...)
* [28827 - \[SC - Insight\] Multi requestid claims can trigger DOS](puffer-finance/28827-sc-insight-multi-requestid-claims-can-trigger-dos)
* [28833 - \[SC - Insight\] Missing slippage protection in functions deposi...](puffer-finance/28833-sc-insight-missing-slippage-protection-in-functions-deposi...)
* [28852 - \[SC - Insight\] Reverting permit transactions caught in the cat...](puffer-finance/28852-sc-insight-reverting-permit-transactions-caught-in-the-cat...)
* [28921 - \[SC - Medium\] Possibly protocol insolvency during a LIDO slas...](puffer-finance/28921-sc-medium-possibly-protocol-insolvency-during-a-lido-slas...)
* [28934 - \[SC - Insight\] TimelockcancelTransaction does not check asser...](puffer-finance/28934-sc-insight-timelockcanceltransaction-does-not-check-asser...)
* [28942 - \[SC - Insight\] Self Destruction of inchRouter can lead to loss...](puffer-finance/28942-sc-insight-self-destruction-of-inchrouter-can-lead-to-loss...)
* [28946 - \[SC - Low\] The assets accounting of the vault can become o...](puffer-finance/28946-sc-low-the-assets-accounting-of-the-vault-can-become-o...)
* [28947 - \[SC - Insight\] Info](puffer-finance/28947-sc-insight-info)
* [28964 - \[SC - Insight\] Claiming withdrawals from Lido can lead to unbo...](puffer-finance/28964-sc-insight-claiming-withdrawals-from-lido-can-lead-to-unbo...)
* [28971 - \[SC - Low\] Double spending or double execution of transact...](puffer-finance/28971-sc-low-double-spending-or-double-execution-of-transact...)
* [28991 - \[SC - Insight\] Contract uint delay variable cannot be set to i...](puffer-finance/28991-sc-insight-contract-uint-delay-variable-cannot-be-set-to-i...)
* [29006 - \[SC - Medium\] Lack of Success check of the Timelock executeT...](puffer-finance/29006-sc-medium-lack-of-success-check-of-the-timelock-executet...)
* [29015 - \[SC - Low\] Boolean return value of addresscall function no...](puffer-finance/29015-sc-low-boolean-return-value-of-addresscall-function-no...)
* [29017 - \[SC - Insight\] Timelock is not capable of performing payable t...](puffer-finance/29017-sc-insight-timelock-is-not-capable-of-performing-payable-t...)
* [29033 - \[SC - High\] Queued data will be lost if Tx is unsuccessful ...](puffer-finance/29033-sc-high-queued-data-will-be-lost-if-tx-is-unsuccessful-...)
* [29054 - \[SC - Medium\] Lido discounted withdrawals are not accounted for](puffer-finance/29054-sc-medium-lido-discounted-withdrawals-are-not-accounted-for)
* [29060 - \[SC - Medium\] initiateETHWithdrawalsFromLido decreases totalA...](puffer-finance/29060-sc-medium-initiateethwithdrawalsfromlido-decreases-totala...)
* [29067 - \[SC - Low\] Puffer Finance Missing Verification of Externa...](puffer-finance/29067-sc-low-puffer-finance-missing-verification-of-externa...)
* [29073 - \[SC - Insight\] excuteTransaction in timelock contract will una...](puffer-finance/29073-sc-insight-excutetransaction-in-timelock-contract-will-una...)
* [29080 - \[SC - Insight\] Uninitialized uups upgradeable can lead to loss...](puffer-finance/29080-sc-insight-uninitialized-uups-upgradeable-can-lead-to-loss...)
* [29081 - \[SC - Insight\] No constructor should be used to set in upgrade...](puffer-finance/29081-sc-insight-no-constructor-should-be-used-to-set-in-upgrade...)
* [29082 - \[SC - Insight\] Restricted modifier should not be used with int...](puffer-finance/29082-sc-insight-restricted-modifier-should-not-be-used-with-int...)
* [29099 - \[SC - Insight\] Actual amount of stETH deposited is less than t...](puffer-finance/29099-sc-insight-actual-amount-of-steth-deposited-is-less-than-t...)
* [29106 - \[SC - High\] Insufficient Handling of Partial Failures in Wi...](puffer-finance/29106-sc-high-insufficient-handling-of-partial-failures-in-wi...)
* [29110 - \[SC - Insight\] Insecure Token Allowance Management in PufferDe...](puffer-finance/29110-sc-insight-insecure-token-allowance-management-in-pufferde...)
* [29111 - \[SC - Insight\] Silent Failure of ERC Permit Calls in PufferDep...](puffer-finance/29111-sc-insight-silent-failure-of-erc-permit-calls-in-pufferdep...)
* [29116 - \[SC - Low\] Using deposit results in more shares for the sa...](puffer-finance/29116-sc-low-using-deposit-results-in-more-shares-for-the-sa...)

</details>
