Immunefi Audit CompetitionsSwaylend | IOP
Reports by Severity
Critical
High
- 35831 - [SC - High] By bypassing base_borrow_min limitation borrows can create inabsorbable loans
- 36117 - [SC - High] Permanent freezing of tokens when user sends extra tokens as update fee
- 35750 - [SC - High] User loss due to Pyth oracle update fee being smaller than the msg amount sent
- 35876 - [SC - High] Users will lose funds on calls to critical functions if the prices are not updated
- 35793 - [SC - High] src-20.burn should use "==" instead of ">="
Medium
- 35853 - [SC - Medium] permissonless constructor always for front-running owner initialization.
- 36034 - [SC - Medium] truncation in the present_value_borrow() can lead to loss of accrued borrow int
- 36137 - [SC - Medium] absorb_internal might be DOSed
- 35815 - [SC - Medium] Market.present_value_borrow should be roundUp
Low
- 35908 - [SC - Low] If the collateral token''s decimal is <= the base token decimal in a market, collat
- 35732 - [SC - Low] Withdrawals can not be paused which could lead to protocol insolvency in case of iss
- 36158 - [SC - Low] Market.collateral_value_to_sell will always revert if collateral_configuration
- 35724 - [SC - Low] Users can withdraw collateral even when the admin pauses the contract.
- 35760 - [SC - Low] market::available_to_borrow() compares the collateral in USD against the borrow in
- 35761 - [SC - Low] Unhandled smaller base decimals than 6 or bigger than the collateral's decimals
Insight
- 35768 - [SC - Insight] Market.set_pyth_contract_id should emit an event
- 36138 - [SC - Insight] Market.update_collateral_asset should reuse old configuration's asset_id
- 36108 - [SC - Insight] recipient with a NULL address will lead to permanent loss of minted coins
- 36065 - [SC - Insight] Market.update_market_configuration should reuse old configuration's base_toke
- 35999 - [SC - Insight] Incorrect event name
- 35794 - [SC - Insight] Market.absorb can be called when Market.supply_collateral is paused
- 35708 - [SC - Insight] Adding too many collaterals will halt the protocol operation
Reports by Type
Smart Contract
- 35853 - [SC - Medium] permissonless constructor always for front-running owner initialization.
- 36034 - [SC - Medium] truncation in the present_value_borrow() can lead to loss of accrued borrow int
- 35908 - [SC - Low] If the collateral token''s decimal is <= the base token decimal in a market, collat
- 35732 - [SC - Low] Withdrawals can not be paused which could lead to protocol insolvency in case of iss
- 35768 - [SC - Insight] Market.set_pyth_contract_id should emit an event
- 35831 - [SC - High] By bypassing base_borrow_min limitation borrows can create inabsorbable loans
- 35684 - [SC - Critical] Incorrect Pyth Oracle Price Feed Process Leads to Wrong Collateral Value Calcul
- 36158 - [SC - Low] Market.collateral_value_to_sell will always revert if collateral_configuration
- 36138 - [SC - Insight] Market.update_collateral_asset should reuse old configuration's asset_id
- 36137 - [SC - Medium] absorb_internal might be DOSed
- 36117 - [SC - High] Permanent freezing of tokens when user sends extra tokens as update fee
- 36108 - [SC - Insight] recipient with a NULL address will lead to permanent loss of minted coins
- 35724 - [SC - Low] Users can withdraw collateral even when the admin pauses the contract.
- 36065 - [SC - Insight] Market.update_market_configuration should reuse old configuration's base_toke
- 35815 - [SC - Medium] Market.present_value_borrow should be roundUp
- 35760 - [SC - Low] market::available_to_borrow() compares the collateral in USD against the borrow in
- 35758 - [SC - Critical] Loss of yield to the protocol due to incorrect interest rate applied
- 35999 - [SC - Insight] Incorrect event name
- 35750 - [SC - High] User loss due to Pyth oracle update fee being smaller than the msg amount sent
- 35794 - [SC - Insight] Market.absorb can be called when Market.supply_collateral is paused
- 35767 - [SC - Critical] constanct value is used to check price.confidence
- 35876 - [SC - High] Users will lose funds on calls to critical functions if the prices are not updated
- 35793 - [SC - High] src-20.burn should use "==" instead of ">="
- 35761 - [SC - Low] Unhandled smaller base decimals than 6 or bigger than the collateral's decimals
- 35708 - [SC - Insight] Adding too many collaterals will halt the protocol operation