complete
source
findings
Found 3 issues: ETH buy path can spend contract ETH without enforcing msg.value, ERC20 transfer return values are unchecked in collateral/underlying payouts, and collateralization relies on a manipulable spot oracle with...
Top findings
-
medium
ETH oToken purchases can spend the contract’s ETH balance without enforcing msg.value
-
medium
Unchecked ERC20 transfers in collateral/underlying payouts can break accounting and lock funds
-
medium
Collateralization relies on a manipulable spot oracle without freshness or sanity checks