|
medium
|
codex |
Fee-on-transfer tokens break escrow accounting and can undercollateralize the bridge |
0xbdae358dc3b0389a5532d011a8b4098ffda11836
|
$0.00 |
no
|
—
|
3 months ago
|
2b03ce69-6667-4e80-a75c-83ddd1a33fc2
|
|
low
|
codex |
Storage gap placed before new variables in TokenServiceV2 |
0xbdae358dc3b0389a5532d011a8b4098ffda11836
|
$0.00 |
no
|
—
|
3 months ago
|
2b03ce69-6667-4e80-a75c-83ddd1a33fc2
|
|
high
|
codex |
Unprotected one-time admin initialization enables takeover |
0x04b28ccf37828978140643525961d20099e63668
|
$637,572.19 |
no
|
—
|
3 months ago
|
6d8fe14b-7be1-4516-b786-7ecb14b9cdbb
|
|
medium
|
codex |
Minting uses requested deposit amount rather than actual received amount |
0x0615dbba33fe61a31c7ed131bda6655ed76748b1
|
$894,622.61 |
no
|
—
|
3 months ago
|
a4ff4f05-4e3e-4551-98c5-e84e98ac3bc8
|
|
low
|
codex |
Transfer destination check always passes due to `||` |
0x0615dbba33fe61a31c7ed131bda6655ed76748b1
|
$894,622.61 |
no
|
—
|
3 months ago
|
a4ff4f05-4e3e-4551-98c5-e84e98ac3bc8
|
|
info
|
codex |
Timelock bypass via changeVault |
0x0615dbba33fe61a31c7ed131bda6655ed76748b1
|
$894,622.61 |
no
|
—
|
3 months ago
|
a4ff4f05-4e3e-4551-98c5-e84e98ac3bc8
|
|
medium
|
codex |
Initializer is publicly callable and sets privileged storage if uninitialized |
0x62c9e5e52351e02635f48072fa20c03bb650f787
|
$0.00 |
no
|
—
|
3 months ago
|
0f14b8a6-911b-4685-a9fc-e61e1077db52
|
|
medium
|
codex |
Collateral accounting assumes full transfer amount (fee-on-transfer tokens can undercollateralize vaults) |
0x173ae6283a717b6cdd5491eac5f82c082a8c674b
|
$892,332.70 |
no
|
—
|
3 months ago
|
f854f1ec-178a-4a54-94b8-ab2eb2947263
|
|
medium
|
codex |
adjust trusts user-supplied collateral amount, enabling undercollateralized minting with fee-on-transfer/non-standard collateral |
0x49c431454c40ecbf848096f2753b2abc3a699a10
|
$0.00 |
no
|
—
|
3 months ago
|
6a86e7ae-30fc-4bd1-b436-7b9d4baa7340
|
|
low
|
codex |
onlyOwner allows calls when owner is zero, leaving uninitialized clones open pre-initialize |
0x49c431454c40ecbf848096f2753b2abc3a699a10
|
$0.00 |
no
|
—
|
3 months ago
|
6a86e7ae-30fc-4bd1-b436-7b9d4baa7340
|
|
low
|
codex |
exchange_received credits surplus balances as input, enabling unauthorized sweeps of donated/rebasing tokens |
0xc26d714c76e98ec65d26a9cdc749734ba6ca03d2
|
$1,022,852.08 |
no
|
—
|
3 months ago
|
85a72693-dd88-4347-ae92-500fe14f685a
|
|
medium
|
codex |
Deposits assume full token amounts received, enabling share inflation with fee-on-transfer tokens |
0x1cb489ef513e1cc35c4657c91853a2e6ff1957de
|
$0.00 |
no
|
—
|
3 months ago
|
f59f0bb7-6545-453b-82db-5db8d94ec4b5
|
|
medium
|
codex |
Share minting is fully oracle-driven without manipulation safeguards |
0x1cb489ef513e1cc35c4657c91853a2e6ff1957de
|
$0.00 |
no
|
—
|
3 months ago
|
f59f0bb7-6545-453b-82db-5db8d94ec4b5
|
|
low
|
codex |
Zero-balance tokens can block full redemptions due to `bal=1` fallback |
0x1cb489ef513e1cc35c4657c91853a2e6ff1957de
|
$0.00 |
no
|
—
|
3 months ago
|
f59f0bb7-6545-453b-82db-5db8d94ec4b5
|
|
medium
|
codex |
Settlement can be blocked if total bids exceed uint96 limit |
0x0b7ffc1f4ad541a4ed16b40d8c37f0929158d101
|
$1,141,455.44 |
no
|
—
|
3 months ago
|
3c876ae7-8ac4-47da-9c32-04123766eae8
|
|
low
|
codex |
Unchecked ERC20 approve return value in wrapper constructor |
0x0b7ffc1f4ad541a4ed16b40d8c37f0929158d101
|
$1,141,455.44 |
no
|
—
|
3 months ago
|
3c876ae7-8ac4-47da-9c32-04123766eae8
|
|
low
|
codex |
Allowlist signatures can be replayed across EasyAuction instances |
0x0b7ffc1f4ad541a4ed16b40d8c37f0929158d101
|
$1,141,455.44 |
no
|
—
|
3 months ago
|
3c876ae7-8ac4-47da-9c32-04123766eae8
|
|
low
|
codex |
Unchecked LP token mint/burn return values can allow silent failures |
0xdcef968d416a41cdac0ed8702fac8128a64241a2
|
$1,222,437.73 |
no
|
—
|
3 months ago
|
733c4190-827e-4a56-b036-325c9efec89e
|
|
low
|
codex |
Internal balances assume full transfer amounts, breaking invariants for fee-on-transfer/rebasing tokens |
0xdcef968d416a41cdac0ed8702fac8128a64241a2
|
$1,222,437.73 |
no
|
—
|
3 months ago
|
733c4190-827e-4a56-b036-325c9efec89e
|
|
medium
|
codex |
Initializer appears publicly callable before initialization flag is set |
0x7b6942434aa457d1520f9cc0a05ede239ecabd37
|
$2,008,201.00 |
no
|
—
|
3 months ago
|
e5711d3e-da45-4a2f-8b00-0c8fc8dc6d76
|
|
high
|
codex |
Reentrancy during module removal can permanently lock the SetToken |
0x07834b06b5756056e065c0bd1639761ab8297513
|
$1,058,531.93 |
no
|
—
|
3 months ago
|
21882865-9b4a-4420-b853-fc947442c2be
|
|
high
|
codex |
Public upgrade initializer allows anyone to set management fee after v1→v2 upgrade |
0xc0026e559da7f2d4ee573616c09a8f721fa599bd
|
$0.00 |
no
|
—
|
3 months ago
|
08e6a475-e8b8-4f68-8143-0dc96c883782
|
|
medium
|
codex |
Blacklist bypass: blacklisted spender can still transfer via transferFrom |
0xc0026e559da7f2d4ee573616c09a8f721fa599bd
|
$0.00 |
no
|
—
|
3 months ago
|
08e6a475-e8b8-4f68-8143-0dc96c883782
|
|
high
|
codex |
YieldLimitExec hooks encode/decode mismatch can revert inbound mints and corrupt accounting |
0xde1617ddb7c8a250a409d986930001985cfad76f
|
$1,043,732.69 |
no
|
—
|
3 months ago
|
8334cc4c-d376-4cae-a657-bd2812b2b250
|
|
medium
|
codex |
StakeEasy lets any caller spend contract-held tokens |
0xde1617ddb7c8a250a409d986930001985cfad76f
|
$1,043,732.69 |
no
|
—
|
3 months ago
|
8334cc4c-d376-4cae-a657-bd2812b2b250
|
|
medium
|
codex |
Pending-share calculation uses pendingUnderlying instead of consumedUnderlying |
0xde1617ddb7c8a250a409d986930001985cfad76f
|
$1,043,732.69 |
no
|
—
|
3 months ago
|
8334cc4c-d376-4cae-a657-bd2812b2b250
|
|
low
|
codex |
Unchecked ERC20 transfer/transferFrom can enable free unwrap or silent accounting drift |
0xde1617ddb7c8a250a409d986930001985cfad76f
|
$1,043,732.69 |
no
|
—
|
3 months ago
|
8334cc4c-d376-4cae-a657-bd2812b2b250
|
|
medium
|
codex |
Replayable failed messages inflate locked funds accounting |
0x61488ae9dedca3f29f5e72bbf23ba975862c20ba
|
$0.00 |
no
|
—
|
3 months ago
|
c4ec9b86-f84f-462e-89f0-0a1a08973858
|
|
medium
|
codex |
Strategy withdrawals do not reconcile actual assets returned, overstating total assets |
0x7f1cec2328170e510f2d0375ce1ba7ac45d1681a
|
$0.00 |
no
|
—
|
3 months ago
|
57ace033-9a1d-4d2f-b70e-f28fa74799da
|
|
medium
|
codex |
AccessManager execution delays are bypassed for PerpManager/Vault privileged actions |
0x7f1cec2328170e510f2d0375ce1ba7ac45d1681a
|
$0.00 |
no
|
—
|
3 months ago
|
57ace033-9a1d-4d2f-b70e-f28fa74799da
|
|
low
|
codex |
Interest fee shares are minted before interest is added, inflating fees |
0x7f1cec2328170e510f2d0375ce1ba7ac45d1681a
|
$0.00 |
no
|
—
|
3 months ago
|
57ace033-9a1d-4d2f-b70e-f28fa74799da
|
|
medium
|
codex |
Mint amount ignores actual stablecoin received (fee-on-transfer/rebasing tokens) |
0xe2e1424687eb676b3807693cbb439362b8ea908e
|
$215,453.57 |
no
|
—
|
3 months ago
|
b1775fcd-29cb-428f-a277-365169de370d
|
|
low
|
codex |
Owner can sweep collateral, leaving minted AID unbacked |
0xe2e1424687eb676b3807693cbb439362b8ea908e
|
$215,453.57 |
no
|
—
|
3 months ago
|
b1775fcd-29cb-428f-a277-365169de370d
|
|
high
|
codex |
Delegatecall to external ORDER_MANAGER_SINGLETON enables full vault takeover if that address is upgradeable/compromised |
0x1d9d0956621bf85d1d4cafc92d76a0448a5e6b9b
|
$0.00 |
no
|
—
|
3 months ago
|
d6e884b9-0d8a-4410-802c-0d7b21b36433
|
|
medium
|
codex |
afterSwap callback is publicly callable with unvalidated parameters |
0x1d9d0956621bf85d1d4cafc92d76a0448a5e6b9b
|
$0.00 |
no
|
—
|
3 months ago
|
d6e884b9-0d8a-4410-802c-0d7b21b36433
|
|
high
|
codex |
Initializer can be front‑run on uninitialized deployments |
0x100dcb8b78c608d148cb207ac3875935dfe6abdc
|
$0.00 |
no
|
—
|
3 months ago
|
63826368-2868-4338-bf44-3f1ac9518ef4
|
|
low
|
codex |
Reward token transfer in updateValset allows reentrancy into state-changing logic |
0x100dcb8b78c608d148cb207ac3875935dfe6abdc
|
$0.00 |
no
|
—
|
3 months ago
|
63826368-2868-4338-bf44-3f1ac9518ef4
|
|
critical
|
codex |
Unrestricted dispatcher initialize allows sub-contract takeover and arbitrary delegatecall |
0x8c43c9bec15d82d153c52518030e0a9590abd35d
|
$0.00 |
no
|
—
|
3 months ago
|
3f64d8b1-7867-4b19-ac8a-e7491ef06aa9
|
|
critical
|
codex |
Unsigned messages accepted when authority set is empty |
0xc664692f38d2528710edbb74f65db6599bc7dee6
|
$0.00 |
no
|
—
|
3 months ago
|
fdefebf3-c8b5-4f78-bd33-56e8577739eb
|
|
high
|
codex |
Fee-on-transfer/deflationary tokens can inflate internal balances and drain other assets |
0x6f400810b62df8e13fded51be75ff5393eaa841f
|
$856,965.32 |
no
|
—
|
3 months ago
|
d999d22b-2dac-4c56-a9ac-4ade13e4db17
|
|
low
|
codex |
Payouts/sweeps use tx.origin as recipient |
0x6dc71298ce1b61ba4c83d5cdf4b3b1e9aa558a7f
|
$1,326,983.83 |
no
|
—
|
3 months ago
|
1a24ef76-b3fa-419d-9583-62d57d946e47
|
|
high
|
codex |
Reentrancy via transfer-out before state updates in borrow/withdraw |
0x3fda67f7583380e67ef93072294a7fac882fd7e7
|
$1,322,493.75 |
no
|
—
|
3 months ago
|
bcdfa77d-89f0-4bd4-94b1-88110b7b2e0f
|
|
medium
|
codex |
Fee-on-transfer tokens can mint unbacked balances due to assuming full transfer-in amount |
0x3fda67f7583380e67ef93072294a7fac882fd7e7
|
$1,322,493.75 |
no
|
—
|
3 months ago
|
bcdfa77d-89f0-4bd4-94b1-88110b7b2e0f
|
|
medium
|
codex |
Unprotected initializer/castrate allow takeover or permanent lock of uninitialized proxies |
0xf0d7d1d47109ba426b9d8a3cde1941327af1eea3
|
$0.00 |
no
|
—
|
3 months ago
|
e7b0ae0c-b4ec-4bef-850f-238760b01a13
|
|
medium
|
codex |
TWAP can collapse to spot price, enabling price manipulation around buy/burn swaps |
0x9217622b957411ac4a5608a9a0689c8a256344d1
|
$1,419,859.62 |
no
|
—
|
3 months ago
|
12d861ef-8f42-4779-a04a-8d1399b51333
|
|
low
|
codex |
Public initializer can be claimed if proxy is left uninitialized |
0x74ae836d6f949118b4e4d0af79924edd0d6fd163
|
$0.00 |
no
|
—
|
3 months ago
|
b842d834-085d-41aa-b331-087260eeb9d9
|
|
medium
|
codex |
Spot-price fallback in TWAP quotes enables sandwiching of buybacks when observations are insufficient |
0x1a4330eaf13869d15014abca69516fc6ab36e54d
|
$1,436,876.75 |
no
|
—
|
3 months ago
|
1477e342-0362-4cb5-8d4e-25617326771b
|
|
medium
|
codex |
Fee-on-transfer/rebasing tokens can inflate internal balances |
0x003ca23fd5f0ca87d01f6ec6cd14a8ae60c2b97d
|
$1,558,282.86 |
no
|
—
|
3 months ago
|
282352a2-0573-4737-ac0f-2601c2a3e40a
|
|
high
|
codex |
Unprotected reinitializer enables proxy takeover if initialization is not atomic |
0x1a5d115a87e39fd8d8c9e53b91dbe5e0ec309dd2
|
$0.00 |
no
|
—
|
3 months ago
|
53258cf0-dc0d-412d-8abb-9515ee4dd8a9
|
|
medium
|
codex |
ERC777-style reentrancy in deposit can mint excess shares |
0xe1237aa7f535b0cc33fd973d66cbf830354d16c7
|
$1,537,209.82 |
no
|
—
|
3 months ago
|
62905bd3-7f23-4198-8cee-9a5bc2390d2a
|