| Severity | Tool | Title | Validated | Confirmed |
|---|---|---|---|---|
| high | detector | Untrusted CALL target/value reachable | no | no |
| high | detector | ETH value transfer possible | no | no |
| high | codex | Unchecked CowSwap feeAmount lets a limit order drain extra sellToken beyond params.amountIn | no | — |
| high | slither | GPv2Transfer.transferFromAccounts(IVault,GPv2Transfer.Data[],address) (lib/contracts/src/contracts/libraries/GPv2Transfer.sol#91-136) uses arbitrary from in transferFrom: transf... | no | — |
| high | slither | GPv2Transfer.fastTransferFromAccount(IVault,GPv2Transfer.Data,address) (lib/contracts/src/contracts/libraries/GPv2Transfer.sol#46-77) uses arbitrary from in transferFrom: transf... | no | — |
| high | slither | TransferLibrary.receiveAssets(address,address,uint256) (src/libraries/TransferLibrary.sol#40-48) uses arbitrary from in transferFrom: IERC20(asset).safeTransferFrom(from,address... | no | — |
| high | slither | StorageAccessible.simulateDelegatecallInternal(address,bytes) (lib/contracts/src/contracts/mixins/StorageAccessible.sol#87-95) uses delegatecall to a input-controlled function id | no | — |
| medium | detector | CREATE/CREATE2 reachable | no | no |
| low | cast | Contract creation opcode present | no | — |
| info | cast | Heavy CALL-family usage | no | — |
| info | cast | Heavy EXTCODE*/BALANCE usage | no | — |
| Run ID | Status | Validated | Total findings | Created |
|---|---|---|---|---|
| 019d5666-f542-7208-84bc-d2e3db83e367 | complete | crit 0 high 0 | 11 | 1 week ago |