{ "schema": 1, "dataVersion": "13193c03c14ec7ba", "siteUrl": "https://crypto.training", "count": 2341, "kinds": { "incident": 979, "audit-finding": 1362 }, "files": { "record": ".json", "all": "all.jsonl", "index": "index.json", "server": "crypto-training-precedents-mcp.tgz" }, "index": { "version": 1, "terms": 34930, "bytes": 3648966 }, "coverage": { "all": { "records": 2341, "rootCause": 2142, "vulnerableCode": 2116, "tldr": 2089, "remediation": 1729, "preconditions": 1796, "attack": 2108, "impact": 1033, "bugClass": 1631, "loss": 1181, "date": 2135, "chain": 1222 }, "AuditVault": { "records": 1362, "rootCause": 1187, "vulnerableCode": 1199, "tldr": 1123, "remediation": 771, "preconditions": 862, "attack": 1160, "impact": 1028, "bugClass": 670, "loss": 219, "date": 1162, "chain": 255 }, "Crypto Training": { "records": 58, "rootCause": 46, "vulnerableCode": 47, "tldr": 58, "remediation": 50, "preconditions": 36, "attack": 51, "impact": 3, "bugClass": 54, "loss": 55, "date": 58, "chain": 53 }, "DeFiHackLabs": { "records": 921, "rootCause": 909, "vulnerableCode": 870, "tldr": 908, "remediation": 908, "preconditions": 898, "attack": 897, "impact": 2, "bugClass": 907, "loss": 907, "date": 915, "chain": 914 } }, "gaps": { "rootCause": [ "2026-10-MakerDAOFlipKeeper", "2026-09-BonfireSwap", "2026-09-DoinGud", "2026-09-EtherFiVedaAtomicQueue", "2026-09-GaslessReservoirEnabler", "2026-09-Nimiq", "2026-09-OrderFactory", "2026-09-RsETHSafeModule", "2026-08-AllbridgeCctpPhantomDeposit", "2026-08-FalconHeavy", "2026-08-ReflexerGEB", "2026-08-StrongBlockGovernanceTakeover", "2026-07-CompoundProvider", "2026-06-ATOHook", "2026-06-CookFinanceIssuance", "2026-06-GnosisPay", "2026-06-JaredFromSubway", "2026-06-Vault4626", "2026-03-DayContract", "2026-03-InfinitySix", "65618-after-the-upgrade-permissionless-attacker-can-fully-drain-th", "63224-mechanism-to-prevent-donation-attack-can-be-gamed-to-cause-w", "63223-users-can-get-their-withdrawal-active-requests-dosed-by-mali", "63176-h-10-takers-can-pay-significantly-less-fees-with-makers-losi", "63177-h-11-takers-pay-significantly-higher-fees-than-expected-due", "63173-h-7-makercollectfees-re-targets-liquidity-to-original-amount", "63174-h-8-incorrect-inside-fees-calculation-for-uninitialized-unis", "63175-h-9-liquidity-borrowed-from-or-repaid-to-parent-nodes-is-not", "63167-ammplify-maker-spot-price", "63179-ammplify-malicious-pool", "62808-h-1-gas-consumed-in-notifyunsubscribe-is-underestimated-duri", "62811-h-4-finalize-window-vote-changing-vulnerability-auto-voters", "63422-h-4-bucket-rewards-will-be-wiped-by-stakeunstake-before-accr", "2025-08-BaseCallback0x8d2e", "63046-h-2-caller-supplied-controltower-lets-anyone-be-the-migrator", "64082-h-4-owner-can-steal-funds-from-contract-by-calling-stakenxm", "64083-h-5-owner-can-hide-a-staked-nft-via-removetokenidatindex-and", "64081-h-3-owner-can-steal-funds-on-withdraw-by-burning-wrong-unisw", "63647-rwfx-undercollateralized-underflow", "62757-yuzu-nonatomic-updatepool", "62106-h-1-consensuschecksignatures-doesnt-check-duplication-of-sig", "61407-c-05-in-credibleaccountmodule-the-validatesessionkeyparams-f", "61412-h-02-in-credibleaccountmodule-the-validateuserop-function-is", "61414-h-04-modularetherspotwallet-can-get-dosed-from-uninstalling", "61413-h-03-the-prepostcheck-is-not-authorizing-the-wallet-paramete", "62110-h-5-incorrect-performance-fee-calculation-in-feemanager-sher", "62111-h-6-redeems-through-redeemqueue-avoid-paying-management-and", "61872-resolv-self-transfer-rewards", "63598-c-01-missing-update-of-extra-reward-per-token-during-deposit", "61232-in-delegatorfactory-new-entity-can-be-created-for-a-blacklis", "62487-h-6-dos-might-happen-to-dinerowithdrawrequestmanager-initiat", "2025-06-BSCArbitraryCall0xb5cb", "61338-h-02-partner-can-receive-zero-share-despite-surplus-shieldif", "62483-h-2-attacker-can-drain-the-entire-suppliers-on-morpho-market", "62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll", "62488-h-7-rewardmanagermixinclaimaccountrewards-lacks-of-necessary", "62593-c-02-missing-packet-id-in-finalizeopen-causes-nft-loss-pasho", "61538-reward-distribution-enables-front-running-attacks-and-reward", "62647-chat-points-manipulation-by-adding-liquidity-to-custom-pools", "57088-an-incorrect-balance-check-for-the-pt-to-sy-swap-can-lead-to", "57093-race-condition-in-yt-swap-and-index-update-can-lead-to-loss", "56810-locked-residual-token-amounts-on-deposit-mixbytes-none-p2por", "58397-h-28-subsequent-crosschain-borrows-dont-accrue-interest-on-e", "61376-asymmetric-first-in-block-swap-initialization-leads-to-stale", "61378-accrued-limit-order-fees-can-be-stolen-openzeppelin-none-ope", "61480-blueberry-tvl-share-inflation", "56953-h-4-incorrect-tax-distribution-when-adding-value-single-side", "56958-h-9-reserve-share-overflows-due-to-too-strict-reward-calcula", "56895-h-01-lp-unstaking-only-burns-the-shares-but-leaves-the-under", "58553-h-01-buffer-silently-locks-staked-hype-in-contract-without-u", "63737-level-zero-heartbeat", "56801-gettermsinfo-reverts-because-of-block-gas-limit-fixed-consen", "43733-h-2-fluidlocker-getunlockingpercentage-uses-540-instead-of-5", "61456-h-03-incorrect-erc20-transfer-implementation-between-evm-and", "61458-blueberry-approved-withdrawals", "57722-h-01-dos-on-mint-and-burn-due-to-overestimation-of-available", "57723-h-02-first-deposit-front-running-attack-pashov-audit-group-n", "55052-referencing-the-gateway-balance-in-lockingcontrollerincrease", "55053-stakedtoken-holders-can-circumvent-restriction-by-approving", "63314-c-01-accepting-duplicate-signatures-from-one-signer-pashov-a", "43732-h-1-fluidlocker-getunlockingpercentage-incorrectly-divides-o", "61559-swaps-are-not-possible-on-pools-registered-with-bunni-due-to", "61558-swaps-performed-in-pools-with-zero-liquidity-can-cause-a-com", "61561-denial-of-service-for-swaps-on-multirangehook-pools-cyfrin-n", "2025-02-BankX", "65088-h-01-missing-signature-duplication-check-in-the-submitcheckp", "65091-h-04-an-attacker-can-overflow-the-count-of-messages-in-a-bot", "65092-h-05-incorrect-supply-fund-transferral-in-function-leave-can", "65093-h-06-reentrancy-in-function", "65094-h-07-incorrect-loop-indexing-in-libaddressstakingreleasescom", "65096-h-09-cross-msg-recipient-can-block-checkpoint-submission-cod", "55111-h-01-overwriting-collateral-breaks-collateral-gains-logic-pa", "55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri", "55396-h-1-mergetgt-has-no-handling-if-tgttoexchange-is-exceeded-du", "48699-abacus-clear-unused-bond", "48701-abacus-past-closure-adjustment", "48698-abacus-token-mapping", "48700-abacus-locked-ether-transfer", "57187-any-attempt-to-liquidate-a-user-will-fail-because-stabilityp", "57871-h-04-fee-theft-via-arbitrary-contract-impersonation-in-colle", "53108-incorrect-margin-calculation-due-to-inconsistent-realized-an", "44334-eywa-escrow-reentrancy", "44337-eywa-poke-dos", "61079-folks-borrow-balance", "61051-folks-unlimited-loan-health", "61091-folks-liquidation-mixing", "56842-potential-read-only-reentrancy-mixbytes-none-xpress-markdown", "56840-incorrect-handling-of-fee-on-transfer-tokens-mixbytes-none-x", "31585-catalyst-tokenid-reconfiguration", "38492-karak-increase-balance-shares", "50685-mismatching-data-location-inheritance", "63524-redeemnative-reentrancy-enables-permanent-fund-freeze-system", "47890-opentrade-loan-validation", "61508-h-01-undervalued-funding-fee-when-accfundingrate-is-negative", "57870-h-03-predictable-token-deployment-address-enables-liquidity", "38286-puffer-partial-withdrawal-failure", "51982-pyth-price-exponent-mismatch", "51984-pyth-missing-payable", "53453-h-01-excess-payment-when-plugin-owner-reduces-price-shieldif", "61396-h-01-session-key-can-be-consumed-by-unauthorized-scw-shieldi", "55142-unstake-causes-all-users-to-lose-rewards", "47980-switchboard-reward-manipulation", "44006-h-02-the-usdt-reward-claiming-functionality-of-vestedstaking", "44004-c-01-malicious-users-can-steal-all-staking-rewards-from-stak", "56784-anyone-can-lock-relayer-refunds-and-contract-can-be-drained", "53124-attacker-can-perform-mev-by-providing-amountoutmin-0-for-all", "53126-insufficient-slippage-protection-in-redeemearlylv-leads-to-m", "53125-reserve-sales-vulnerable-to-mev-due-to-missing-slippage-prot", "55233-h-6-attacker-can-exploits-batch-sender-role-to-block-result", "55229-h-2-malicious-validators-will-bypass-consensus-threshold-req", "45459-autonomint-cross-chain-price", "45461-autonomint-downside-dos", "45458-autonomint-excess-profit", "45457-autonomint-odos-data", "45456-autonomint-redeem-yields", "45460-autonomint-withdraw-accounting", "44375-h-5-attacker-can-drain-stoplimit-contract-funds-through-brac", "44372-h-2-attackers-can-drain-the-oracleless-contract-by-creating", "44373-h-3-lack-of-nonreentrant-modifier-in-fillorder-and-modifyord", "44371-h-1-unsafe-type-casting-in-token-amount-handling-sherlock-ok", "43530-axion-buyback-liquidity", "60731-incorrect-accounting-in-removeorder-leading-to-loss-of-orde", "2024-08-AAVE_Repay_Adapter", "60700-native-tokens-from-the-l1-liquidity-pools-could-be-drained-d", "60699-using-the-wrong-selector-causes-token-loss-during-erc1155-br", "41091-h-05-exposed-removecredidperaddress-addcredidperaddress-al", "41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at", "37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t", "60243-inconsistent-use-of-basis-points-leading-to-enormous-fees-qu", "60261-excess-funds-are-locked-in-the-bounty-contract-quantstamp-ar", "60148-the-protocol-can-be-drained-through-commitment-duplication-q", "60495-locked-funds-when-fulfilling-seaport-orders-quantstamp-nifty", "60332-invalidated-block-hash-in-cross-layer-communication-quantsta", "60329-reentrancy-lets-relayer-withdraw-more-than-expected-by-bond", "59428-incorrect-reward-updates-upon-xintx-minting-quantstamp-inten", "33298-tokenbridgebridgetoken-allows-1-way-erc721-bridging-causing", "59205-signature-replay-quantstamp-netmind-markdown", "40684-beacon-chain-withdrawals-that-occur-at-lastwithdrawaltimesta", "58812-validators-can-submit-multiple-attestations-to-maliciously-f", "59402-redeeming-does-not-discount-tokens-of-removed-artists-leadin", "32315-h-04-incorrect-approval-mechanism-breaks-all-magnetar-functi", "32312-h-01-magnetarmintxchainmodulesolmintbblendxchainsgl-can-be-u", "32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet", "32313-h-02-missing-check-on-helper-contract-allows-arbitrary-actio", "40820-incorrect-reward-distribution-when-t-roundedtimestamp-in-fee", "40821-missing-accesscontrol-in-afterlockupdate-cantina-none-zerole", "31276-the-previous-milestone-stem-should-be-scaled-for-use-with-th", "29738-a-user-can-steal-an-already-transfered-and-bridged-resdl-loc", "29745-not-update-rewards-in-handleincomingupdate-function-of-sdlpo", "28948-h-1-liquidator-can-liquidate-user-while-increasing-user-posi", "28949-h-2-vault-leverage-can-be-increased-to-any-value-up-to-min-m", "35121-h-8-malicious-users-can-steal-reward-tokens-via-re-entrancy", "31192-h-3-reentrancy-in-vestingsolclaim-will-allow-users-to-drain", "27048-h-02-by-delegating-to-a-non-transcoder-a-delegator-can-reduc", "27047-h-01-underflow-in-updatetranscoderwithfees-can-cause-corrupt", "54672-owner-can-be-temporarily-changed-within-proxy-calls-allowing", "54666-plugins-can-be-maliciously-overridden-by-colliding-signature", "27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the", "54691-requirevalidadjustmentincurrentmode-bypass-when-not-in-mintl", "26042-h-08-due-to-inadequate-checks-an-adversary-can-call-branchbr", "26043-h-09-rootbridgeagent-checkparamslibcheckparams-does-not-chec", "26041-h-07-redeem-in-beforeredeem-is-using-the-wrong-owner-paramet", "26044-h-10-talosbasestrategyinit-lacks-slippage-protection-code4re", "26048-h-14-user-may-underpay-for-the-remote-call-executiongas-on-t", "20224-h-01-exchange-liquidate-function-can-cause-liquidator-to-bur", "20225-h-02-hedging-during-liquidation-is-incorrect-code4rena-polyn", "24903-h-03-the-collect-function-will-always-transfer-zero-fees-los", "25723-h-01-data-corruption-in-nftfloororacle-denial-of-service-cod", "15978-h-05-attacker-can-manipulate-low-tvl-uniswap-v3-pool-to-borr", "15981-h-08-nftfloororacles-asset-and-feeder-structures-can-be-corr", "15982-h-09-uniswapv3-tokens-of-certain-pairs-will-be-wrongly-value", "15983-h-10-attacker-can-drain-pool-using-executebuywithcredit-with", "19123-yield-ninja-withdraw-accounting", "20308-zerem-unlock-exponent", "17624-compromise-of-a-single-oracle-enables-limited-control-of-the", "17100-origin-token-migration-marketplace-reference", "42395-h-04-improper-implementation-of-arbitrarycall-allows-protoco", "42396-h-10-recovertokens-doesnt-work-when-issale-is-true-code4rena", "42394-h-02-tokens-can-be-stolen-when-deposittoken-rewardtoken-code" ], "vulnerableCode": [ "2026-09-CozyFinance", "2026-09-DHC", "2026-09-MUS", "2026-09-NotionalFinance", "2026-09-SecuredFi", "2026-08-BaseUnverifiedArbitraryCall_a317", "2026-08-PantherBase", "2026-08-StrongBlockGovernanceTakeover", "2026-07-CompoundProvider", "2026-07-edel-xstock", "2026-07-Hinkal", "2026-07-LienFinance", "2026-07-LULA", "2026-07-ProToken", "2026-07-ProjektRewardVault", "2026-07-SummerFi", "2026-07-UnprotectedArbBot", "2026-06-AztecEscapeHatch_exp2", "2026-05-AurellionLabs", "2026-05-ONTR", "2026-05-SKP_exp2", "2026-04-BlockchainBets", "2026-03-Curve_LlamaLend", "2026-03-MovieToken", "65374-users-can-participate-in-an-infinite-number-of-games-they-ha", "65379-if-multiple-users-call-defaultsessionassertresults-all-but-t", "65375-impossible-for-user-to-get-refund-after-re-joining-a-resched", "65373-attacker-can-drain-all-tokens-from-cancelled-game-since-sess", "65377-impossible-to-claim-rewards-when-ranked-rewards-or-number-of", "65378-impossible-to-claim-rewards-when-xptiers-are-not-set-resulti", "64041-c-01-unrestricted-router-allows-unauthorized-merkle-root-set", "65027-h-03-commission-fees-can-always-be-bypassed-code4rena-panopt", "65026-h-02-cross-contract-reentrancy-in-liquidation-enables-conver", "64140-h-01-attacker-can-steal-jackpotticketnfts-from-jackpotbridge", "64142-h-03-lp-pool-cap-may-be-exceeded-on-drawing-settlement-code4", "64141-h-02-unoptimized-subset-matches-counting-implementation-will", "64079-h-1-attacker-can-profit-by-manipulating-uniswap-liquidity-sh", "2025-10-BaseSwapCallback", "64195-h-1-pool-managers-can-steal-all-other-pools-pending-deposits", "63167-ammplify-maker-spot-price", "63179-ammplify-malicious-pool", "62808-h-1-gas-consumed-in-notifyunsubscribe-is-underestimated-duri", "62811-h-4-finalize-window-vote-changing-vulnerability-auto-voters", "64325-totalbalanceenforcer-validation-bypass-when-mixed-with-state", "2025-08-0xf340", "2025-08-BaseCallback0x8d2e", "63046-h-2-caller-supplied-controltower-lets-anyone-be-the-migrator", "2025-08-d3xai", "64082-h-4-owner-can-steal-funds-from-contract-by-calling-stakenxm", "64083-h-5-owner-can-hide-a-staked-nft-via-removetokenidatindex-and", "2025-08-MulticallWithXera", "64081-h-3-owner-can-steal-funds-on-withdraw-by-burning-wrong-unisw", "63647-rwfx-undercollateralized-underflow", "62757-yuzu-nonatomic-updatepool", "62106-h-1-consensuschecksignatures-doesnt-check-duplication-of-sig", "62110-h-5-incorrect-performance-fee-calculation-in-feemanager-sher", "62111-h-6-redeems-through-redeemqueue-avoid-paying-management-and", "61872-resolv-self-transfer-rewards", "62487-h-6-dos-might-happen-to-dinerowithdrawrequestmanager-initiat", "2025-06-BSCArbitraryCall0xb5cb", "62483-h-2-attacker-can-drain-the-entire-suppliers-on-morpho-market", "62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll", "62488-h-7-rewardmanagermixinclaimaccountrewards-lacks-of-necessary", "62593-c-02-missing-packet-id-in-finalizeopen-causes-nft-loss-pasho", "61540-stakedcap-decimals-price", "61536-fee-auction-zero-assets", "61537-health-vs-slashable-collateral", "61528-inconsistent-balance-tracking-vault-dos", "61535-unvalidated-vault-address-interest-rate", "62647-chat-points-manipulation-by-adding-liquidity-to-custom-pools", "58397-h-28-subsequent-crosschain-borrows-dont-accrue-interest-on-e", "2025-05-Unwarp", "61480-blueberry-tvl-share-inflation", "63737-level-zero-heartbeat", "43733-h-2-fluidlocker-getunlockingpercentage-uses-540-instead-of-5", "61458-blueberry-approved-withdrawals", "55052-referencing-the-gateway-balance-in-lockingcontrollerincrease", "43732-h-1-fluidlocker-getunlockingpercentage-incorrectly-divides-o", "55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri", "55396-h-1-mergetgt-has-no-handling-if-tgttoexchange-is-exceeded-du", "48699-abacus-clear-unused-bond", "48701-abacus-past-closure-adjustment", "48698-abacus-token-mapping", "48700-abacus-locked-ether-transfer", "57871-h-04-fee-theft-via-arbitrary-contract-impersonation-in-colle", "53108-incorrect-margin-calculation-due-to-inconsistent-realized-an", "44334-eywa-escrow-reentrancy", "44337-eywa-poke-dos", "61079-folks-borrow-balance", "61051-folks-unlimited-loan-health", "61091-folks-liquidation-mixing", "31585-catalyst-tokenid-reconfiguration", "38492-karak-increase-balance-shares", "50685-mismatching-data-location-inheritance", "56703-h-01-cross-chain-signature-replay-attack-due-to-user-supplie", "47890-opentrade-loan-validation", "57870-h-03-predictable-token-deployment-address-enables-liquidity", "38286-puffer-partial-withdrawal-failure", "51982-pyth-price-exponent-mismatch", "51984-pyth-missing-payable", "53453-h-01-excess-payment-when-plugin-owner-reduces-price-shieldif", "61396-h-01-session-key-can-be-consumed-by-unauthorized-scw-shieldi", "64682-h-02-blacklisted-operators-can-not-be-revoked-from-being-an", "45292-instant-withdrawals-in-priority-pool-can-result-in-loss-of-f", "47980-switchboard-reward-manipulation", "44006-h-02-the-usdt-reward-claiming-functionality-of-vestedstaking", "44004-c-01-malicious-users-can-steal-all-staking-rewards-from-stak", "53124-attacker-can-perform-mev-by-providing-amountoutmin-0-for-all", "53126-insufficient-slippage-protection-in-redeemearlylv-leads-to-m", "53125-reserve-sales-vulnerable-to-mev-due-to-missing-slippage-prot", "2024-12-GemPadLock", "55233-h-6-attacker-can-exploits-batch-sender-role-to-block-result", "55229-h-2-malicious-validators-will-bypass-consensus-threshold-req", "45459-autonomint-cross-chain-price", "45461-autonomint-downside-dos", "45458-autonomint-excess-profit", "45457-autonomint-odos-data", "45456-autonomint-redeem-yields", "45460-autonomint-withdraw-accounting", "45464-h-11-borrower-withdrawing-at-a-loss-will-cause-losses-for-cd", "44375-h-5-attacker-can-drain-stoplimit-contract-funds-through-brac", "44372-h-2-attackers-can-drain-the-oracleless-contract-by-creating", "44373-h-3-lack-of-nonreentrant-modifier-in-fillorder-and-modifyord", "44371-h-1-unsafe-type-casting-in-token-amount-handling-sherlock-ok", "43530-axion-buyback-liquidity", "2024-10-P719Token", "2024-09-AIRBTC", "41091-h-05-exposed-removecredidperaddress-addcredidperaddress-al", "41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at", "37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t", "38003-draining-the-protocol-fully-codehawks-zaros-git", "2024-05-TGC", "33495-h-08-incorrect-withdraw-queue-balance-in-tvl-calculation-cod", "40684-beacon-chain-withdrawals-that-occur-at-lastwithdrawaltimesta", "2024-03-IT", "2024-02-EGGX", "51374-re-entrancy-causes-draining-of-funds-through-withdraw-swapto", "51369-withdrawals-are-blocked-due-to-wrong-function-name-on-the-cu", "51376-vulnerability-in-compounder-contract-allowing-compromised-eo", "51370-broken-stargate-deposit-flow-due-to-missing-allowance-halbor", "32315-h-04-incorrect-approval-mechanism-breaks-all-magnetar-functi", "32312-h-01-magnetarmintxchainmodulesolmintbblendxchainsgl-can-be-u", "32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet", "32313-h-02-missing-check-on-helper-contract-allows-arbitrary-actio", "50682-unlimited-minting-by-reusing-failed-hyperlane-messages-halbo", "40820-incorrect-reward-distribution-when-t-roundedtimestamp-in-fee", "40821-missing-accesscontrol-in-afterlockupdate-cantina-none-zerole", "31275-failure-to-add-modified-facets-and-facets-with-modified-depe", "38179-malicious-user-can-mint-unlimited-flux-tokens-immunefi-alche", "2023-11-MEV_0x8c2d", "2023-11-TrustPad", "28948-h-1-liquidator-can-liquidate-user-while-increasing-user-posi", "28949-h-2-vault-leverage-can-be-increased-to-any-value-up-to-min-m", "29526-h-05-permanent-dos-due-to-non-shrinking-array-usage-in-an-un", "29347-h-01-incorrect-calculations-for-surplus-auction-creation-cau", "35121-h-8-malicious-users-can-steal-reward-tokens-via-re-entrancy", "31192-h-3-reentrancy-in-vestingsolclaim-will-allow-users-to-drain", "27048-h-02-by-delegating-to-a-non-transcoder-a-delegator-can-reduc", "27047-h-01-underflow-in-updatetranscoderwithfees-can-cause-corrupt", "2023-08-SVT", "26346-h-1-liquidatepartya-requires-signature-which-doesnt-have-non", "55637-h-05-closeanytime-timestamp-is-never-validated-against-prici", "54672-owner-can-be-temporarily-changed-within-proxy-calls-allowing", "54666-plugins-can-be-maliciously-overridden-by-colliding-signature", "27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the", "54691-requirevalidadjustmentincurrentmode-bypass-when-not-in-mintl", "26042-h-08-due-to-inadequate-checks-an-adversary-can-call-branchbr", "26043-h-09-rootbridgeagent-checkparamslibcheckparams-does-not-chec", "26041-h-07-redeem-in-beforeredeem-is-using-the-wrong-owner-paramet", "26044-h-10-talosbasestrategyinit-lacks-slippage-protection-code4re", "26048-h-14-user-may-underpay-for-the-remote-call-executiongas-on-t", "48951-h-12-dos-of-market-operations-with-malicious-offers-code4ren", "48954-h-15-the-last-borrowed-asset-will-not-be-collateralized-and", "48953-h-14-users-might-get-less-assets-than-expected-upon-migratio", "48952-h-13-when-opening-a-position-the-collateral-of-the-previous", "48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the", "48950-h-11-rubiconmarket-checks-slippage-incorrectly-code4rena-rub", "16038-h-01-bond-max-buyer-might-end-up-buying-the-max-buy-of-the-n", "16040-h-03-dmutesol-attacker-can-push-lock-items-to-victims-array", "2023-03-Paraspace_exp_2", "20224-h-01-exchange-liquidate-function-can-cause-liquidator-to-bur", "20225-h-02-hedging-during-liquidation-is-incorrect-code4rena-polyn", "29664-low-level-call-missing-existence-check", "24903-h-03-the-collect-function-will-always-transfer-zero-fees-los", "17856-degate-arbitrary-token-balance-check", "2022-11-MEV_0ad8", "19123-yield-ninja-withdraw-accounting", "20308-zerem-unlock-exponent", "2022-08-Circle_exp1", "42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill", "2022-04-Wdoge", "2022-03-Agave", "2022-03-Auctus", "2022-03-Bacon", "2022-03-CompoundTusd", "2022-03-Fantasm", "2022-03-HundredFinance", "2022-03-OneRing", "2022-03-Paraluni", "2022-03-RedactedCartel", "2022-03-Revest", "2022-03-Ronin", "2022-03-Umbrella", "2022-02-Meter", "2022-02-TecraSpace", "2022-02-Sandbox", "2022-01-Anyswap", "24657-h-03-a-malicious-treasury-manager-can-burn-treasury-tokens-b", "17097-origin-malicious-erc20-finalization-dos", "17095-origin-marketplace-repeated-withdraw", "42395-h-04-improper-implementation-of-arbitrarycall-allows-protoco", "42396-h-10-recovertokens-doesnt-work-when-issale-is-true-code4rena", "42394-h-02-tokens-can-be-stolen-when-deposittoken-rewardtoken-code", "18030-liquity-zero-icr-trove-removal", "16980-yield-v2-witch-buy-payall-no-auction", "2021-03-PAID", "2021-02-Yearn_ydai", "25134-h-05-routers-are-not-enforced-to-repay-aave-portal-loan-code", "16739-aztec-confidentialapprove-replay-status", "16736-aztec-swap-validator-missing-pairing-check", "63976-h-01-anyone-can-finalize-the-sale-early-via-testfinalizesett", "57739-h-02-insufficient-liquidity-checks-for-put-may-cause-exercis", "36354-h-14-incorrect-parameters-bricks-certain-functions-pashov-au", "33493-h-06-the-amount-of-xezeth-in-circulation-will-not-represent", "63075-malicious-actor-can-overwrite-others-user-state-via-1-wei-va" ], "remediation": [ "2026-08-BaseUnverifiedArbitraryCall_a317", "2026-08-FalconHeavy", "2026-08-PantherBase", "2026-08-StrongBlockGovernanceTakeover", "2026-07-LienFinance", "2026-07-LULA", "2026-07-LumiFinance", "2026-07-ProToken", "2026-07-ProjektRewardVault", "2026-07-UnprotectedArbBot", "2026-03-DayContract", "2026-03-InfinitySix", "2026-03-MovieToken", "65419-myriadctfexchangematchcrossmarketorders-allows-taker-to-rece", "65528-surplusprocesssurplus-always-reverts-for-managed-collateral", "65582-adapter-vault-userwsteth-not-cleared-after-redemption-enabl", "65583-circular-slippage-protection-in-sablierlidoadapter-wstethtow", "65374-users-can-participate-in-an-infinite-number-of-games-they-ha", "65379-if-multiple-users-call-defaultsessionassertresults-all-but-t", "65375-impossible-for-user-to-get-refund-after-re-joining-a-resched", "65373-attacker-can-drain-all-tokens-from-cancelled-game-since-sess", "65377-impossible-to-claim-rewards-when-ranked-rewards-or-number-of", "65378-impossible-to-claim-rewards-when-xptiers-are-not-set-resulti", "65328-user-can-bypass-lock-and-withdraw-stake-anytime-cyfrin-none", "65329-global-mp-cap-invariant-can-be-broken-on-unstake-causing-ari", "64041-c-01-unrestricted-router-allows-unauthorized-merkle-root-set", "64955-h-1-user-can-abuse-rounding-issue-in-order-to-borrow-unbacke", "65027-h-03-commission-fees-can-always-be-bypassed-code4rena-panopt", "65026-h-02-cross-contract-reentrancy-in-liquidation-enables-conver", "64140-h-01-attacker-can-steal-jackpotticketnfts-from-jackpotbridge", "64142-h-03-lp-pool-cap-may-be-exceeded-on-drawing-settlement-code4", "64141-h-02-unoptimized-subset-matches-counting-implementation-will", "64079-h-1-attacker-can-profit-by-manipulating-uniswap-liquidity-sh", "62973-accountableopenterm-loan-interest-cannot-be-repaid-once-prin", "62968-cancelling-redeem-requests-permanently-blocks-the-withdrawal", "63719-h-01-bonuses-obtainable-without-proper-locking-due-to-flawed", "63720-h-02-delegating-to-address0-empties-contract-via-altergovern", "63717-c-01-instantwithdraw-does-not-transfer-amountforcontract-lo", "64195-h-1-pool-managers-can-steal-all-other-pools-pending-deposits", "63707-h-01-assets-deposited-before-calculating-shares-amount-to-mi", "63777-signatures-on-tokenbank-and-allowlist-can-be-reused-in-perpe", "63780-divide-before-multiply-loses-precision-in-fivefiftyrule-upda", "63779-migrating-the-existing-locks-for-an-investor-when-is-resolve", "63776-signaturevalidatorsetallowlist-is-unrestricted-leading-to-fr", "63761-h-02-partial-signature-replayfrontrunning-attack-on-session", "63008-all-rewards-can-be-stolen-due-to-incorrect-active-liquidity", "63224-mechanism-to-prevent-donation-attack-can-be-gamed-to-cause-w", "63222-withdrawers-of-susde-always-incur-a-loss-because-parameters", "63223-users-can-get-their-withdrawal-active-requests-dosed-by-mali", "63176-h-10-takers-can-pay-significantly-less-fees-with-makers-losi", "63177-h-11-takers-pay-significantly-higher-fees-than-expected-due", "63169-h-3-mismatch-in-actual-pools-liquidity-and-pool-nodes-liquid", "63171-h-5-borrow-fee-uses-apy-as-per-second-rate-causing-extreme-o", "63172-h-6-user-can-lose-all-funds-when-creating-or-increasing-comp", "63173-h-7-makercollectfees-re-targets-liquidity-to-original-amount", "63174-h-8-incorrect-inside-fees-calculation-for-uninitialized-unis", "63175-h-9-liquidity-borrowed-from-or-repaid-to-parent-nodes-is-not", "63167-ammplify-maker-spot-price", "63179-ammplify-malicious-pool", "62808-h-1-gas-consumed-in-notifyunsubscribe-is-underestimated-duri", "62811-h-4-finalize-window-vote-changing-vulnerability-auto-voters", "62350-licreditydecreasedebtshare-bypasses-interest-accrual-cyfrin", "62349-self-triggered-licredity-afterswap-back-run-enables-lp-fee-f", "62348-swap-and-pop-without-index-fix-up-corrupts-positions-fungibl", "64325-totalbalanceenforcer-validation-bypass-when-mixed-with-state", "63422-h-4-bucket-rewards-will-be-wiped-by-stakeunstake-before-accr", "63046-h-2-caller-supplied-controltower-lets-anyone-be-the-migrator", "64082-h-4-owner-can-steal-funds-from-contract-by-calling-stakenxm", "64851-h-03-gtelaunchpadv2pairburn-over-estimates-distribution-amou", "64854-h-06-donations-to-distributor-with-arbitrary-quotetoken-can", "64857-h-09-dos-of-launchpad-graduation-via-addliquidity-with-1-wei", "64853-h-05-gtelaunchpadv2pair-permits-minting-lp-tokens-for-free-w", "64856-h-08-create2-address-of-the-uniswap-pair-used-by-launchpad-d", "64852-h-04-attacker-can-drain-funds-from-gtelaunchpadv2pair-using", "64083-h-5-owner-can-hide-a-staked-nft-via-removetokenidatindex-and", "64081-h-3-owner-can-steal-funds-on-withdraw-by-burning-wrong-unisw", "63647-rwfx-undercollateralized-underflow", "62757-yuzu-nonatomic-updatepool", "62256-proposals-created-with-voting-mode-earlyexecution-are-vulner", "62106-h-1-consensuschecksignatures-doesnt-check-duplication-of-sig", "62110-h-5-incorrect-performance-fee-calculation-in-feemanager-sher", "64871-h-03-dos-attack-via-order-amendment-bypassing-maxlimitspertx", "62108-h-3-unable-to-withdraw-native-tokens-because-vault-and-redee", "62109-h-4-protocol-fee-multiple-accrual-in-oraclesubmitreports-she", "62107-h-2-redeemqueue-accounting-mismatch-between-batch-creation-a", "62111-h-6-redeems-through-redeemqueue-avoid-paying-management-and", "61872-resolv-self-transfer-rewards", "63598-c-01-missing-update-of-extra-reward-per-token-during-deposit", "61229-dust-limit-attack-on-forceupdatenodes-allows-dos-of-rebalanc", "61231-blacklisted-implementation-versions-are-accessible-through-m", "61328-fees-can-be-stolen-from-partially-unwrapped-uniswapv4wrapper", "61327-liquidations-can-be-made-to-revert-by-an-attacker-through-va", "61329-more-value-can-be-extracted-by-liquidations-than-expected-du", "62487-h-6-dos-might-happen-to-dinerowithdrawrequestmanager-initiat", "57869-h-02-in-finalize-the-minttodao-amount-of-tokens-are-permane", "57866-c-01-complete-drainage-of-vested-tokens-from-claim-in-daoves", "57923-reward-accumulation-manipulation-through-frequent-claims-mix", "61408-c-06-anyone-can-uninstall-the-validator-module-from-any-wall", "61410-c-08-in-resourcelockvalidator-the-validateuserop-function-la", "62483-h-2-attacker-can-drain-the-entire-suppliers-on-morpho-market", "62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll", "62488-h-7-rewardmanagermixinclaimaccountrewards-lacks-of-necessary", "58066-c-02-lack-of-lastmintedperiod-update-allows-unlimited-mintin", "58065-c-01-rebasereward-fails-because-of-incorrect-token-handling", "58068-h-01-votingreward-not-set-on-gauge-pashov-audit-group-none-k", "62092-h-01-the-poolexposure-for-token1-is-erroneously-calculated-a", "58282-h-2-pumponomics-can-be-skipped-when-using-fluidlockerprovide", "58281-h-1-staked-tokens-inside-fluidlocker-can-be-withdrawn-withou", "63676-h-01-strwip-is-always-minted-for-rwip-in-a-11-ratio-pashov-a", "58333-h-01-router-address-validation-logic-error-prevents-valid-ro", "58334-h-02-reward-token-in-gaugefactorycl-can-be-drained-by-anyone", "61494-h-01-escrowtvl-does-not-add-in-flight-usdc-amount-pashov-aud", "62593-c-02-missing-packet-id-in-finalizeopen-causes-nft-loss-pasho", "61540-stakedcap-decimals-price", "61536-fee-auction-zero-assets", "61537-health-vs-slashable-collateral", "61528-inconsistent-balance-tracking-vault-dos", "61535-unvalidated-vault-address-interest-rate", "62647-chat-points-manipulation-by-adding-liquidity-to-custom-pools", "58580-h-3-attacker-can-steal-an-high-value-token-due-to-lack-of-sw", "58579-h-2-any-attacker-will-steal-accumulated-zrc20-tokens-from-ga", "58578-h-1-missing-swap-withdrawal-validation-enables-accumulated-t", "58582-h-5-unauthorized-claim-of-non-evm-chain-refunds-in-claimrefu", "58581-h-4-gatewaytransfernativewithdrawtonativechain-allows-swappi", "57088-an-incorrect-balance-check-for-the-pt-to-sy-swap-can-lead-to", "57093-race-condition-in-yt-swap-and-index-update-can-lead-to-loss", "58129-h-02-gettradeskewpriceimpactp-function-ignores-trade-contrac", "58131-h-04-traders-could-lose-assets-when-increasing-counter-trade", "57883-c-01-first-depositor-can-inflate-share-price-to-steal-funds", "57886-h-01-incorrect-withdrawal-state-update-causes-partial-withdr", "57888-h-03-partial-withdrawers-suffer-double-fee-charging-due-to-s", "57889-h-04-faulty-nav-update-logic-creates-compounding-asset-deple", "57887-h-02-incorrect-fee-calculation-period-leads-to-overcharging", "58013-h-02-loss-of-claimable-rewards-upon-gauge-deactivation-pasho", "58015-h-04-duplicate-tokenid-in-delegate-list-may-inflate-votes-pa", "58016-h-05-incorrect-last-pointblk-calculation-due-to-shared-memor", "56947-h-1-incorrect-tier-tracking-when-tier-3-staker-exits-in-a-ce", "56948-h-2-when-stakercountintree-increases-some-users-may-receive", "56810-locked-residual-token-amounts-on-deposit-mixbytes-none-p2por", "57907-h-01-predictable-randomness-in-activity-outcomes-shieldify-n", "66188-h-26-stale-interest-accrual-allows-over-borrowing-pashov-aud", "58397-h-28-subsequent-crosschain-borrows-dont-accrue-interest-on-e", "61280-incorrect-storage-slot-derivation-breaks-authorization-spear", "57687-h-2-attacker-can-deposit-after-the-keeper-reports-a-loss-but", "57686-h-1-a-malicious-attacker-can-steal-25-of-the-funds-of-the-fi", "61477-c-02-missing-asset-index-check-allows-any-token-to-mint-shar", "61480-blueberry-tvl-share-inflation", "56950-h-1-incorrect-handling-of-erc4626-vaults-with-fees-sherlock", "56953-h-4-incorrect-tax-distribution-when-adding-value-single-side", "56958-h-9-reserve-share-overflows-due-to-too-strict-reward-calcula", "56954-h-5-attacker-captures-unclaimed-fees-by-timing-deposit-with", "56895-h-01-lp-unstaking-only-burns-the-shares-but-leaves-the-under", "55703-h-01-early-72-digit-adjustment-in-sqrt-will-lead-to-incorrec", "55704-h-02-sqrt-function-silently-reverts-the-entire-control-flow", "55706-h-04-unwrapping-while-equating-inside-the-eq-function-fails", "55707-h-05-precision-loss-in-topackedfloat-function-when-mantissa", "58555-h-03-mishandling-of-receiving-hype-in-the-stakingmanager-use", "58553-h-01-buffer-silently-locks-staked-hype-in-contract-without-u", "63737-level-zero-heartbeat", "56801-gettermsinfo-reverts-because-of-block-gas-limit-fixed-consen", "43733-h-2-fluidlocker-getunlockingpercentage-uses-540-instead-of-5", "53948-h-02-the-flashloan-protection-for-zappers-is-insufficient-we", "49515-h-03-stakers-can-lose-their-earned-asugar-shieldify-none-ber", "49516-h-04-owner-cannot-claim-token-fees-shieldify-none-beraji-ko", "49513-h-01-attacker-can-redirect-funds-to-staking-via-allowances-s", "49514-h-02-users-might-not-be-able-to-fully-claim-shieldify-none-b", "63148-c-01-missing-delegatecall-check-pashov-audit-group-none-bico", "61458-blueberry-approved-withdrawals", "61471-h-03-precision-loss-in-withdrawfroml1vault-can-cause-asset", "53947-h-01-bold-batch-shares-math-can-be-rebased-by-combining-roun", "57722-h-01-dos-on-mint-and-burn-due-to-overestimation-of-available", "57723-h-02-first-deposit-front-running-attack-pashov-audit-group-n", "57743-h-06-payoff-underflow-in-operationaltreasury-locks-assets-pe", "55052-referencing-the-gateway-balance-in-lockingcontrollerincrease", "55053-stakedtoken-holders-can-circumvent-restriction-by-approving", "58596-precision-truncation-on-stake-may-lead-to-improper-accountin", "61553-reward-tokens-can-become-inaccessible-due-to-revert-when-rew", "61554-poolrewards-arrays-can-grow-without-bounds-resulting-in-dos", "63314-c-01-accepting-duplicate-signatures-from-one-signer-pashov-a", "43732-h-1-fluidlocker-getunlockingpercentage-incorrectly-divides-o", "2025-02-BankX", "62062-h-02-user-can-steal-other-users-emissions-due-to-vulnerable", "53446-malicious-user-can-flood-a-user-s-staked-locks-array-and-pre", "58616-h-08-exchange-rate-calculation-is-incorrect-pashov-audit-gro", "58615-h-07-exchange-rate-implementation-not-used-in-token-operatio", "58613-h-05-funds-can-be-permanently-locked-due-to-unsafe-type-cast", "58614-h-06-some-stakers-may-fail-to-withdraw-staking-hype-pashov-a", "58610-h-02-validatormanager-missing-fund-withdrawal-from-validator", "57712-c-01-miscalculation-in-rewardswill-give-toomuchrewardstouser", "55111-h-01-overwriting-collateral-breaks-collateral-gains-logic-pa", "54896-incorrect-ft-reserve-used-in-buytoken-leads-to-incorrect-ft", "54895-the-totalft-and-accretingprincipal-are-updated-incorrectly-i", "55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri", "55396-h-1-mergetgt-has-no-handling-if-tgttoexchange-is-exceeded-du", "52680-no-token-distribution-in-batchrelease-due-to-premature-state", "48699-abacus-clear-unused-bond", "48701-abacus-past-closure-adjustment", "48698-abacus-token-mapping", "48700-abacus-locked-ether-transfer", "57187-any-attempt-to-liquidate-a-user-will-fail-because-stabilityp", "55210-c-03-unrestricted-diamondcut-allows-unauthorized-facet-modif", "57871-h-04-fee-theft-via-arbitrary-contract-impersonation-in-colle", "53108-incorrect-margin-calculation-due-to-inconsistent-realized-an", "53328-h-10-validatesignature-does-not-properly-handle-address0-pa", "61411-h-01-no-check-for-userop-and-userophash-mismatch-nor-the-val", "44334-eywa-escrow-reentrancy", "44337-eywa-poke-dos", "61079-folks-borrow-balance", "61051-folks-unlimited-loan-health", "61091-folks-liquidation-mixing", "53302-h-01-swap-is-vulnerable-to-sandwich-attacks-pashov-audit-gr", "53330-h-12-getpositionvalue-does-not-consider-accumulated-fees-pas", "56842-potential-read-only-reentrancy-mixbytes-none-xpress-markdown", "56840-incorrect-handling-of-fee-on-transfer-tokens-mixbytes-none-x", "31585-catalyst-tokenid-reconfiguration", "50064-h-01-adversary-can-win-proposals-with-voting-power-as-low-as", "38492-karak-increase-balance-shares", "50051-h-01-the-calculation-of-totalassets-could-be-wrong-if-operat", "50685-mismatching-data-location-inheritance", "56703-h-01-cross-chain-signature-replay-attack-due-to-user-supplie", "63524-redeemnative-reentrancy-enables-permanent-fund-freeze-system", "53317-c-06-borrow-should-decrease-totalassets-value-pashov-audit-g", "53315-c-04-funds-get-locked-in-the-vault-pashov-audit-group-none-o", "53326-h-08-omooracle-getliquidityamounts-uses-spot-price-making-it", "53320-h-02-the-transferfrom-in-omoroutersol-has-approval-vulnerabi", "47890-opentrade-loan-validation", "52747-h-2-vault-inflation-attack-in-autocompoundingpodlp-is-possib", "52748-h-3-pod-dos-if-the-leave-as-paired-lp-token-option-is-enable", "45979-h-4-when-account-is-liquidated-protected-liquidator-can-incr", "57870-h-03-predictable-token-deployment-address-enables-liquidity", "38286-puffer-partial-withdrawal-failure", "51982-pyth-price-exponent-mismatch", "51984-pyth-missing-payable", "53453-h-01-excess-payment-when-plugin-owner-reduces-price-shieldif", "61396-h-01-session-key-can-be-consumed-by-unauthorized-scw-shieldi", "64682-h-02-blacklisted-operators-can-not-be-revoked-from-being-an", "55142-unstake-causes-all-users-to-lose-rewards", "47980-switchboard-reward-manipulation", "44006-h-02-the-usdt-reward-claiming-functionality-of-vestedstaking", "44004-c-01-malicious-users-can-steal-all-staking-rewards-from-stak", "56784-anyone-can-lock-relayer-refunds-and-contract-can-be-drained", "49180-mix-of-scaled-and-non-scaled-parameters-in-aftertokentransf", "49181-dosing-vault-rehypothecation-through-flashloans-spearbit-non", "53124-attacker-can-perform-mev-by-providing-amountoutmin-0-for-all", "53126-insufficient-slippage-protection-in-redeemearlylv-leads-to-m", "53125-reserve-sales-vulnerable-to-mev-due-to-missing-slippage-prot", "57954-h-02-the-target-weight-check-does-not-account-for-redeem-req", "2024-12-GemPadLock", "50036-c-01-anyone-can-re-mint-a-token-that-was-burned-by-the-owner", "50038-h-02-lzreceive-call-for-releaseoneid-results-in-oog-error-pa", "50037-h-01-executecallback-call-causes-that-ownership-cannot-be-up", "55233-h-6-attacker-can-exploits-batch-sender-role-to-block-result", "49676-critical-malicious-user-can-delete-all-users-deposited-liqui", "55229-h-2-malicious-validators-will-bypass-consensus-threshold-req", "45462-h-9-abondtokentransferfrom-does-not-work-as-intended-and-all", "45459-autonomint-cross-chain-price", "45461-autonomint-downside-dos", "45458-autonomint-excess-profit", "45457-autonomint-odos-data", "45456-autonomint-redeem-yields", "45460-autonomint-withdraw-accounting", "45465-h-12-total-cds-deposited-amount-is-incorrectly-modified-when", "45463-h-10-users-can-withdraw-liquidated-collateral-sherlock-auton", "45464-h-11-borrower-withdrawing-at-a-loss-will-cause-losses-for-cd", "44375-h-5-attacker-can-drain-stoplimit-contract-funds-through-brac", "50017-h-01-executetransactionfromoutside-does-not-increment-the-no", "43738-h-1-detaching-hsg-when-theres-non-unregistered-owners-who-no", "44376-h-6-failure-to-reset-unspent-approval-to-the-target-address", "44374-h-4-users-can-modify-a-cancelled-order-withdrawing-the-same", "44378-h-8-insecure-calls-to-safetransferfrom-leads-to-users-tokens", "44372-h-2-attackers-can-drain-the-oracleless-contract-by-creating", "44373-h-3-lack-of-nonreentrant-modifier-in-fillorder-and-modifyord", "46246-overpayment-to-bidder-in-slash-function-due-to-incorrect-amo", "43734-h-3-fontaine-never-stops-the-flows-to-the-tax-and-recipient", "46494-layerzeroadapterexecutemessages-could-lead-to-irrecoverable", "46466-premature-createpair-function-call-will-result-in-the-creati", "46493-permanent-failure-to-bridge-wrapped-erc721-using-bridgesende", "44371-h-1-unsafe-type-casting-in-token-amount-handling-sherlock-ok", "43530-axion-buyback-liquidity", "43812-erc-7484-registry-checks-missing-on-calls-to-modules-spearbi", "44224-h-1-lenders-and-borrowers-can-not-claim-liquidation-token-af", "45235-h-01-createpoold650e2d0-will-not-work-due-to-mismatch-in-sol", "41692-h-05-users-cannot-stake-in-univ3staking-pashov-audit-group-n", "42061-validationdata-not-always-intersected-properly-cantina-none", "42062-enable-mode-can-be-frontrun-to-add-policies-for-a-different", "42064-erc-7739-does-not-use-correct-verifyingcontract-address-cant", "41476-h-2-flashswaprouteremptyreserve-and-flashswaprouteremptyrese", "41749-h-11-user-can-unlock-protected-listing-without-paying-any-fe", "41743-h-5-stale-shutdown-params-can-be-reused-to-drain-all-funds-f", "61079-wrong-borrow-balance-calculation-in-the-getloanliquidity-fun", "52222-minting-limit-calculation-may-prevent-legitimate-claims-halb", "41091-h-05-exposed-removecredidperaddress-addcredidperaddress-al", "41090-h-04-forced-endtime-extension-in-updateartsettings-allows-at", "43397-h-06-reentrancy-in-creating-creds-allows-an-attacker-to-stea", "46674-missing-permissions-check-in-withdraw-and-redeem-functions-i", "46672-user-rewards-can-be-permissionlessly-erased-cantina-none-roy", "41366-h-02-use-of-msgvalue-inside-a-loop-pashov-audit-group-none-s", "41367-h-03-orderamount-not-accounted-when-filling-pashov-audit-gro", "36914-h-02-incorrectly-assigned-decimal1-parameter-upon-decoding-c", "52006-signature-does-not-take-all-parameters-into-account-and-can", "37590-non-standard-erc20-tokens-could-be-locked-in-the-contract-zo", "61051-attacker-can-get-unlimited-loan-for-some-minimum-deposit-due", "51279-missing-xgorplestoken-decrement-in-finalizeredeemfor-halborn", "58121-h-01-inconsistent-spread-and-price-impact-charges-pashov-aud", "50881-non-refunded-excess-fee-in-setpricesfrompricefeed-function", "37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t", "37918-h-04-generation-mint-count-reset-forged-token-cap-bypass-code4rena", "37920-h-06-entropy-generator-initialize-alpha-indices-wrong-modifier-code4rena", "60243-inconsistent-use-of-basis-points-leading-to-enormous-fees-qu", "60261-excess-funds-are-locked-in-the-bounty-contract-quantstamp-ar", "58098-h-01-accounts-not-properly-removed-from-roles-upon-revoking", "60148-the-protocol-can-be-drained-through-commitment-duplication-q", "60329-reentrancy-lets-relayer-withdraw-more-than-expected-by-bond", "47356-inflation-of-pool-balances-ottersec-none-stargate-v2-pdf", "41817-h-7-when-bad-debt-is-accumulated-the-loss-is-not-shared-amon", "47228-claimer-fee-exploitation-ottersec-none-ethsign-launchpad-pdf", "59428-incorrect-reward-updates-upon-xintx-minting-quantstamp-inten", "33595-h-02-invalid-validation-allows-users-to-unlock-early-code4re", "33594-h-01-malicious-user-can-call-lockonbehalf-repeatedly-extend", "33466-h-10-flash-loan-protection-mechanism-can-be-bypassed-via-sel", "47343-denial-of-slashing-ottersec-none-ethos-evm-pdf", "35205-h-03-function-distribute-lacks-access-control-allowing-anyon", "35212-h-10-the-attackers-front-running-repayloans-so-that-the-debt", "35211-h-09-incorrect-accounting-of-pendingwithdrawal-in-queueclai", "35206-h-04-function-refinancefromloanexecutiondata-does-not-check", "35208-h-06-function-settlewithbuyout-does-not-call-loanmanagerloan", "35207-h-05-triggerfee-is-stolen-from-other-auctions-during-settlew", "59205-signature-replay-quantstamp-netmind-markdown", "33495-h-08-incorrect-withdraw-queue-balance-in-tvl-calculation-cod", "32129-h-01-native-gas-tokens-can-become-stuck-in-asdrouter-contrac", "40684-beacon-chain-withdrawals-that-occur-at-lastwithdrawaltimesta", "58812-validators-can-submit-multiple-attestations-to-maliciously-f", "31930-h-02-validity-and-contests-bond-ca-be-incorrectly-burned-for", "59402-redeeming-does-not-discount-tokens-of-removed-artists-leadin", "32318-h-07-incorrect-math-means-dataremoveandrepaydataremoveassetf", "32315-h-04-incorrect-approval-mechanism-breaks-all-magnetar-functi", "32312-h-01-magnetarmintxchainmodulesolmintbblendxchainsgl-can-be-u", "32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet", "32313-h-02-missing-check-on-helper-contract-allows-arbitrary-actio", "58100-h-03-flash-loan-not-working-due-to-transferfrom-issue-pashov", "58101-h-04-withdraw-worst-price-will-distort-shareprice-pashov-aud", "30259-h-03-fillorder-executor-can-be-front-run-by-the-order-creato", "30258-h-02-orders-creator-can-update-tokenout-to-arbitrary-token-c", "58244-c-01-gateway-creator-can-steal-all-tokens-from-the-gatewayre", "58246-h-02-computationunitsavailable-can-overestimate-number-of-av", "40820-incorrect-reward-distribution-when-t-roundedtimestamp-in-fee", "40821-missing-accesscontrol-in-afterlockupdate-cantina-none-zerole", "31275-failure-to-add-modified-facets-and-facets-with-modified-depe", "29591-h-03-handlerepay-of-moneymarkethook-does-not-consider-the-a", "30089-h-02-artpiecetotalvotessupply-and-artpiecequorumvotes-are-in", "28948-h-1-liquidator-can-liquidate-user-while-increasing-user-posi", "28949-h-2-vault-leverage-can-be-increased-to-any-value-up-to-min-m", "29526-h-05-permanent-dos-due-to-non-shrinking-array-usage-in-an-un", "29347-h-01-incorrect-calculations-for-surplus-auction-creation-cau", "35121-h-8-malicious-users-can-steal-reward-tokens-via-re-entrancy", "31192-h-3-reentrancy-in-vestingsolclaim-will-allow-users-to-drain", "47891-incorrect-timestamp-calculation-ottersec-none-opentrade-pdf", "44920-missing-onlygelatorelay-modifier-zokyo-none-tradable-markdow", "27048-h-02-by-delegating-to-a-non-transcoder-a-delegator-can-reduc", "27047-h-01-underflow-in-updatetranscoderwithfees-can-cause-corrupt", "26346-h-1-liquidatepartya-requires-signature-which-doesnt-have-non", "55633-h-01-payments-for-coupons-to-booster-are-irretrievable-0x52", "54672-owner-can-be-temporarily-changed-within-proxy-calls-allowing", "54666-plugins-can-be-maliciously-overridden-by-colliding-signature", "27531-h-41-rewards-compounded-in-aavestrategy-are-unredeemable-cod", "27529-h-39-aavestrategysol-changing-swapper-breaks-the-contract-co", "27530-h-40-balancerstrategysol-withdraw-withdraws-insufficient-to", "27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the", "27533-h-43-accounted-balance-of-glpstrategy-does-not-match-withdra", "27528-h-38-magnetar-contract-has-no-approval-checking-code4rena-ta", "27535-h-45-sglliquidation-computeassetamounttosolvency-market-isso", "27534-h-44-bigbangrepay-and-singularityrepay-spend-more-than-allow", "27532-h-42-attacker-can-steal-victims-otap-position-contents-via-m", "47911-inaccurate-withdrawable-token-amount-ottersec-none-vtvl-pdf", "47981-unchecked-fund-provision-ottersec-none-switchboard-evm-pdf", "54691-requirevalidadjustmentincurrentmode-bypass-when-not-in-mintl", "20070-h-02-positionmanagers-moveliquidity-can-set-wrong-deposit-ti", "20069-h-01-positionmanagers-moveliquidity-can-freeze-funds-by-remo", "26042-h-08-due-to-inadequate-checks-an-adversary-can-call-branchbr", "26043-h-09-rootbridgeagent-checkparamslibcheckparams-does-not-chec", "26041-h-07-redeem-in-beforeredeem-is-using-the-wrong-owner-paramet", "26044-h-10-talosbasestrategyinit-lacks-slippage-protection-code4re", "26048-h-14-user-may-underpay-for-the-remote-call-executiongas-on-t", "20018-h-03-when-the-challenge-is-successful-the-user-can-send-toke", "20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen", "48951-h-12-dos-of-market-operations-with-malicious-offers-code4ren", "48956-h-17-first-depositor-bug-on-unmodified-compound-fork-code4re", "48954-h-15-the-last-borrowed-asset-will-not-be-collateralized-and", "48953-h-14-users-might-get-less-assets-than-expected-upon-migratio", "48952-h-13-when-opening-a-position-the-collateral-of-the-previous", "48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the", "48950-h-11-rubiconmarket-checks-slippage-incorrectly-code4rena-rub", "48949-h-10-some-offers-cant-be-cancelled-code4rena-rubicon-rubicon", "16038-h-01-bond-max-buyer-might-end-up-buying-the-max-buy-of-the-n", "16040-h-03-dmutesol-attacker-can-push-lock-items-to-victims-array", "20224-h-01-exchange-liquidate-function-can-cause-liquidator-to-bur", "20225-h-02-hedging-during-liquidation-is-incorrect-code4rena-polyn", "29664-low-level-call-missing-existence-check", "29663-unprotected-callcode-allows-anyone-to-destroy-the-hyvm-maste", "24903-h-03-the-collect-function-will-always-transfer-zero-fees-los", "17856-degate-arbitrary-token-balance-check", "43033-h-10-giantmevandfeespoolbringunusedethbackintogiantpool-func", "43034-h-12-sender-transferring-giantmevandfeespool-tokens-can-afte", "43027-h-04-unstaking-does-not-update-the-mapping-sethuserclaimfork", "19123-yield-ninja-withdraw-accounting", "20308-zerem-unlock-exponent", "42876-h-01-standardpolicyerc1155sol-returns-amount-1-instead-of-am", "57634-eth-can-get-stuck-on-the-contract-zokyo-none-onemind-markdow", "57636-royalties-might-get-stuck-on-the-contract-zokyo-none-onemind", "57560-issues-with-token-transfers-and-rewards-when-a-marinator-is", "57533-user-funds-lock-in-mystaking-due-to-stakercount-manipulation", "57534-fee-can-be-applied-multiple-times-to-same-rewards-in-mystaki", "57531-stake-begin-time-updated-before-reward-calculation-in-mystak", "57532-incorrect-storage-of-user-rewards-during-staking-in-mystakin", "57521-reentrancy-in-main-functions-zokyo-none-trustswap-markdown", "25133-h-04-in-execute-the-amount-routers-pay-is-what-user-signed-b", "42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill", "17624-compromise-of-a-single-oracle-enables-limited-control-of-the", "42454-h-03-double-transfer-in-the-transferandcall-function-of-erc6", "42453-h-01-lack-of-access-control-on-assertgovernanceapproved-can", "24657-h-03-a-malicious-treasury-manager-can-burn-treasury-tokens-b", "17097-origin-malicious-erc20-finalization-dos", "17095-origin-marketplace-repeated-withdraw", "17100-origin-token-migration-marketplace-reference", "42326-h-03-beneficiary-cant-get-fairsideconviction-nft-unless-they", "42395-h-04-improper-implementation-of-arbitrarycall-allows-protoco", "42396-h-10-recovertokens-doesnt-work-when-issale-is-true-code4rena", "42394-h-02-tokens-can-be-stolen-when-deposittoken-rewardtoken-code", "42336-h-14-anyone-can-arbitrarily-mint-fungible-tokens-in-vaderpoo", "42335-h-13-anyone-can-arbitrarily-mint-synthetic-assets-in-vaderpo", "42333-h-02-redemption-value-of-synths-can-be-manipulated-to-drain", "18030-liquity-zero-icr-trove-removal", "16980-yield-v2-witch-buy-payall-no-auction", "25134-h-05-routers-are-not-enforced-to-repay-aave-portal-loan-code", "65079-h-01-claim-allows-payouts-from-an-arbitrary-token-pool-not-t", "62971-partial-redemptions-can-be-used-to-steal-assets-cyfrin-none", "62972-accountableasyncredeemvaultfulfillredeemrequest-ignores-proc", "62970-critical-dos-in-queue-processing-if-async-cancellations-are", "62969-accountableasyncredeemvaultfulfillcancelredeemrequest-can-de", "38196-malicious-user-can-steal-flux-token-by-abusing-voterpoke-imm", "38189-lack-of-access-control-in-poke-function-allows-in-unlimited", "63178-h-12-missing-width-scaling-in-feewalkerup-non-visited-underc", "63170-h-4-uncollected-fees-from-users-nft-position-are-stuck-in-nf", "63937-c-01-anyone-can-re-initialize-the-swapproxy-pashov-audit-gro", "58097-c-02-wrong-usage-of-mapping-target-in-cancelredeemrequest-pa", "32467-attacker-can-stall-undelegations-openzeppelin-none-forta-sta", "63500-double-order-attack-via-callback-mechanism-mixbytes-none-bar", "63501-replay-attack-via-balance-based-nonce-mixbytes-none-barter-d", "20530-c-02-reentrancy-allows-any-user-allowed-even-one-free-honeyj", "61470-h-02-donated-tokens-are-never-deposited-into-vaults-pashov-a", "61468-c-01-incorrect-fee-due-to-double-subtracting-requestsumasset", "61457-h-04-malicious-users-may-block-other-withdrawals-pashov-audi", "61469-h-01-flawed-withdrawal-logic-when-caller-differs-from-share", "61478-h-01-getrate-ignores-szdecimals-pashov-audit-group-none-blue", "61454-h-01-unapproved-requests-are-not-deducted-from-total-assets", "61455-h-02-withdraw-check-can-be-bypassed-pashov-audit-group-none", "62809-h-2-users-voting-weight-can-be-double-counted-when-finalize", "63718-c-02-stakes-not-forwarded-post-delegation-positions-unwithdr", "64665-eligible-supply-is-not-reduced-on-late-entry-spearbit-none-b", "64666-totalexcludedsupply-drifts-from-reality-spearbit-none-buck-l", "64664-abi-struct-mismatch-in-band-config-spearbit-none-buck-labs-s", "56951-burve-incorrect-implementation-of-erc4626viewadjustor", "56955-burve-fee-bypass-in-valuefacet-removevaluesingle", "55209-c-02-incorrect-cumulativevalue-in-liqfacetaddliq-gives-less", "56952-burve-incorrect-netting-logic-leads-to-excessive-withdrawal-amounts", "56956-burve-noopvault-donation-attack-drains-assets-from-a-closure", "56957-h-8-valuefacetremovevaluesingle-will-withdraw-less-than-requ", "61950-c-01-carryvoteforward-enables-double-voting-pashov-audit-gro", "36310-c-01-withdrawing-collateral-and-fees-and-bypassing-trust-saf", "55503-c-02-pending-stake-not-accounted-for-in-liquidity-calculatio", "63357-h-01-malicious-users-can-brick-vault-operations-by-exploitin", "57953-h-01-incorrect-basket-usd-value-will-cause-incorrect-results", "62822-h-01-not-excluding-accruedprotocolfee-from-state-update-oper", "55092-crestal-network-anyone-approving-blueprintv5-can-drain-erc20-via-payment-paywitherc20", "41690-h-03-updatexp-can-be-omitted-during-liquidation-pashov-audit", "63542-c-02-withdrawal-requests-through-deposit-pool-lost-permanent", "63543-c-03-tvl-errors-by-including-pending-withdrawal-assets-pasho", "63546-h-03-scaling-error-in-elyasset-price-calculation-leads-to-fe", "63541-c-01-receivefromdepositpool-does-not-track-assets-transferre", "63544-h-01-tvl-double-counts-assets-returned-from-strategy-to-vaul", "63547-h-04-strategy-allocation-tracking-errors-affect-tvl-calculat", "62849-h-02-paid-tokens-by-smart-contract-wallets-are-not-refunded", "55523-double-counting-of-the-migrated-stake-mixbytes-none-euler-ma", "61788-attacker-can-lock-user-funds-through-redeem-function-openzep", "65649-fluid-processnormalsupplyaction-permits-an-uncapped-withdrawal", "61019-infinite-interest-rate-bug-immunefi-folks-finance-git", "55705-h-03-natural-logarithm-function-silently-accepts-invalid-non", "58127-c-01-decrease-position-can-be-abused-to-withdraw-pnl-twice-p", "40188-h-01-inconsistent-spread-and-price-impact-charges-pashov-aud", "58128-h-01-holding-fees-accounting-discrepancy-when-collateral-is", "53286-h-03-soulbound-tokens-cannot-be-minted-or-burnt-due-to-an-in", "64870-h-02-dust-orders-can-block-order-posting-code4rena-gte-gte-g", "64835-h-02-backstop-bid-side-frozen-by-tick-size-constraint-code4r", "64869-h-01-order-double-linked-list-is-broken-because-orderprevord", "64858-h-10-protocol-fails-to-charge-fees-from-swap-amount-code4ren", "63976-h-01-anyone-can-finalize-the-sale-early-via-testfinalizesett", "63977-h-02-the-finalizesettlement-can-be-dossed-leading-to-refund", "63683-c-01-incorrect-reward-calculation-pashov-audit-group-none-hy", "63684-h-01-cross-contract-signature-replay-allows-users-to-inflate", "57739-h-02-insufficient-liquidity-checks-for-put-may-cause-exercis", "63922-h-01-deprecated-safeapprove-usage-blocks-collateral-approval", "57824-h-03-non-perpetual-locks-gaining-extra-delegation-power-pash", "58706-h-01-payers-exploit-reentrantsettle-to-bypass-payments-with", "38491-h-03-activevalidatorcount-is-never-set-or-increased-pashov-a", "58611-h-03-deactivated-validator-retains-old-balance-after-reactiv", "58609-h-01-addrebalancerequest-may-use-outdated-balance-for-deleg", "58612-h-04-reportslashingevent-reverts-if-outdated-balance-is-belo", "58157-h-06-lack-of-access-control-in-clgauge-creation-allows-unaut", "58151-c-02-clgauge-sends-kitten-rewards-to-itself-instead-of-to-st", "61952-h-02-reward-rates-can-be-reset-to-0-and-future-rewards-can-b", "58154-h-03-externalbribeearned-skips-rewards-before-the-last-token", "58153-h-02-loss-of-claimable-rewards-upon-gauge-deactivation-pasho", "58207-c-03-incentive-rewards-may-be-stolen-pashov-audit-group-none", "61951-h-01-repeated-distributions-for-killed-gauges-can-block-vali", "58206-c-02-lack-of-lastmintedperiod-update-allows-unlimited-mintin", "61953-h-03-permissionless-voting-through-votercarryvoteforward-pas", "58155-h-04-duplicate-tokenid-in-delegate-list-may-inflate-votes-pa", "58010-c-01-split-can-be-abused-to-create-locked-data-with-an-arbit", "58208-h-01-votingreward-not-set-on-gauge-pashov-audit-group-none-k", "58379-lend-malicious-liquidator-can-liquidate-without-providing-collateral", "58384-lend-incorrect-distribution-of-lend-tokens-to-users", "58386-lend-liquidating-corerouter-can-cause-excess-borrower-loss", "58392-lend-cross-chain-collateral-is-miscalculated-in-borrowwithinterest", "58391-lend-liquidation-validation-logic-is-wrong", "58377-lend-cross-chain-liquidation-computes-maxliquidatable-incorrectly", "58388-lend-cross-chain-liquidation-reduces-debt-by-collateral-seized", "58381-lend-incorrect-lend-reward-distribution-for-cross-chain-borrows", "58374-lend-wrong-l-token-seize-amount-in-liquidatecrosschain", "58390-lend-borrower-can-redeem-collateral-immediately-after-borrowing", "58395-lend-cross-chain-debt-accrues-incorrectly", "58370-lend-repeated-claims-of-the-same-rewards-drain-lend-reserves", "58396-lend-corerouter-borrow-has-an-incorrect-collateral-check", "58376-lend-corerouter-redemption-payout-is-miscalculated", "58378-lend-supplying-uses-an-outdated-exchange-rate", "58375-lend-cross-chain-borrow-ignores-existing-debt-in-collateral-validation", "58383-lend-cross-chain-liquidation-uses-the-wrong-srctoken", "58393-lend-cross-chain-repayment-updates-the-wrong-borrow-balance", "58385-lend-cross-chain-repayment-updates-same-chain-borrow-balances", "58371-lend-protocol-reward-tokens-are-permanently-stuck", "33354-h-01-availability-of-deposit-invariant-can-be-bypassed-code4", "58543-h-01-incorrect-vesting-interest-calculation-enables-mev-atta", "36354-h-14-incorrect-parameters-bricks-certain-functions-pashov-au", "65372-depositmanager-refundentryfee-doesnt-deduct-referral-rewards", "65376-depositmanagergetrewards-always-includes-referrer-fee-result", "62723-h-1-rebalancer-can-steal-funds-from-markets-by-sending-to-cu", "62716-h-01-full-restricted-users-can-still-deposit-kann-none-manif", "62715-c-01-first-deposit-can-result-in-zero-shares-due-to-direct-t", "65418-oracle-void-outcome-leaves-predictionmarketv3managerclobvoid", "63525-inability-to-claim-rewards-from-the-curve-gauge-mixbytes-non", "62486-h-5-migraterewardpool-fails-due-to-incompatible-storage-desi", "62694-arithmetic-overflow-in-getprice-when-feeds-return-large-valu", "62662-buffer-drainage-through-repeated-rebase-calls-due-to-stale-s", "18210-lack-of-return-value-checks-can-lead-to-unexpected-results-t", "65201-h-03-lp-providers-will-not-get-liquidation-fee-most-times-pa", "65199-h-01-function-unlockdeposit-adds-discounted-assets-as-trader", "63445-h-01-stakers-may-fail-to-claim-all-incentives-pashov-audit-g", "65025-h-01-builderwallet-init-is-unprotectedre-initializable-enabl", "25724-h-08-nftfloororacles-asset-and-feeder-structures-can-be-corr", "65286-c-01-missing-authorization-in-withdraw-and-redeem-allows-the", "62866-expired-token-groups-not-synchronized-with-erc1155-balance-t", "58205-c-01-rebasereward-fails-because-of-incorrect-token-handling", "63402-h-02-borrowers-can-avoid-paying-interest-for-lenders-pashov", "63401-h-01-parameter-change-skews-getters-pashov-audit-group-none", "63781-updating-the-entity-allowance-when-the-individual-belongs-to", "63778-pending-payouts-when-resolving-an-investor-are-lost-because", "33493-h-06-the-amount-of-xezeth-in-circulation-will-not-represent", "27331-h-01-custom-redemption-might-revert-if-old-assets-were-unreg", "27332-h-02-a-new-era-might-be-triggered-despite-a-significant-valu", "62187-h-01-transferfee-uses-an-incorrect-transfer-method-pashov-au", "62543-h-06-incorrect-pendingcounts-calculation-pashov-audit-group", "62541-h-04-dos-risk-from-pending-prize-locking-mechanism-pashov-au", "62542-h-05-currency-validation-missing-in-listing-and-offer-reques", "62594-h-01-missing-index-updates-in-burnpacketfrominventory-cause", "62539-h-02-insufficient-restrictions-in-instantopenpacket-risk-dos", "62544-h-07-spinlottery-will-break-if-the-first-prizeid-is-selected", "55113-h-03-incorrect-boost-management-leads-to-staking-reward-loss", "41365-h-01-signatures-can-be-replayed-using-different-addresses-pa", "62540-h-03-prize-locking-mechanism-inconsistency-with-weight-propo", "63599-c-02-checkpoints-are-almost-always-outdated-due-to-missing", "43026-h-02-rewards-of-giantmevandfeespool-can-be-locked-for-all-us", "65327-any-slasher-can-increase-another-ones-reveal-delays-cyfrin-n", "65322-any-staker-can-fully-avoid-slashing-by-triggering-oog-revert", "65324-malicious-actors-can-force-vaults-to-exit-if-they-wish-to-ge", "65326-anyone-can-dodge-reveal-delays-by-providing-unrelated-accoun", "65325-malicious-actors-can-get-free-rewards-if-contract-gets-pause", "64080-h-2-the-vault-can-be-drained-sherlock-steth-by-easedefi-git", "58248-h-04-lack-of-access-control-on-tsqds-registertokenonl2-pasho", "31547-h-02-computationunitsavailable-can-overestimate-number-of-av", "58245-h-01-missing-check-on-toblock-allows-distributors-to-change", "58247-h-03-workers-could-withdraw-without-deregister-and-waiting-f", "65495-h-01-missing-authorization-check-allows-unauthorized-fund-wi", "63420-h-2-attackers-will-steal-rewards-from-legitimate-pools-by-ma", "63419-h-1-users-with-pre-campaign-trades-will-drain-cashback-funds", "63075-malicious-actor-can-overwrite-others-user-state-via-1-wei-va", "63077-controller-and-receiver-cannot-redeem-shares-after-depositin", "63076-strategisthooksroot-permissions-may-be-circumvented-by-any-s", "63081-cancelled-redeem-requests-make-shares-permanently-unredeemab", "63290-h-01-permissionless-sendcurrentoperatorskeys-pashov-audit-gr", "64975-direct-vault-deposits-incorrectly-counted-as-revenue-leading", "64973-redeem-nonce-mis-tracked-enables-replay-spearbit-none-tenbin", "64974-revenue-accounting-ignores-losses-spearbit-none-tenbin-pdf", "62638-c-01-withdrawal-calculation-causes-underflow-locking-all-use", "63508-requestredemption-reverts-because-l1btcredeemerwormholes-ban", "37915-h-01-wrong-minting-logic-based-on-total-token-count-across-g", "62524-infinite-loop-in-tick-iteration-due-to-misaligned-current-ti", "18535-h-3-depositfee-can-be-bypassed-via-deposit-queue-sherlock-no", "18534-h-2-earlier-users-in-rollover-queue-can-grief-later-users-sh", "19124-h-02-first-vault-depositor-can-steal-subsequent-depositors-t", "62756-h-01-pending-withdrawals-in-yuzuilp-contract-are-not-conside", "62758-h-03-fee-avoidance-possible-by-uncollected-fees-in-pool-acco", "63315-c-02-emptying-eth-from-zkpaysol-pashov-audit-group-none-sxt", "56710-potential-signature-replay-attack-in-erc1271handler-openzepp" ], "tldr": [ "2026-08-PantherBase", "2026-07-CompoundProvider", "2026-07-LienFinance", "2026-07-LULA", "2026-07-ProToken", "2026-07-ProjektRewardVault", "2026-07-UnprotectedArbBot", "61176-accounting-on-paymentsettler-will-be-corrupted-when-changi", "61177-paymentsettler-can-change-stablecoin-but-remoratoken-cant-", "61175-attacker-can-make-pledge-on-behalf-of-users-if-those-users", "61172-pledgemanagerpledge-refundtokens-will-revert-due-to-overfl", "61174-a-single-holder-can-grief-the-payouts-of-all-holders-forwa", "61173-distribution-of-payouts-will-revert-due-to-overflow-when-p", "62491-h-10-malicious-user-can-change-the-tradetype-to-steal-funds", "62492-h-11-missing-slippage-protection-in-expired-pt-redemption-ca", "62484-h-3-dinerowithdrawrequestmanager-vulnerable-to-token-overw", "62487-h-6-dos-might-happen-to-dinerowithdrawrequestmanager-initi", "62489-h-8-incorrect-assumption-that-one-1-pendle-standard-yield-sy", "62490-h-9-hardcoded-useeth-true-in-remove-liquidity-one-coin-or-", "55694-h-03-rewarddistributorclaim-will-revert-for-tokens-with-expi", "58380-h-11-users-will-lose-funds-due-to-token-decimal-mismatches", "58387-h-18-incorrect-srceid-check-in-borrowwithinterest-sherlock", "58389-h-20-multiple-cross-chain-borrows-using-same-collateral-sh", "58372-h-3-user-can-evade-liquidation-and-bridge-funds-by-exploit", "56955-h-6-fee-bypass-in-valuefacetremovevaluesingle-sherlock-bur", "56954-h-5-attacker-captures-unclaimed-fees-by-timing-deposit-with", "57712-c-01-miscalculation-in-rewardswill-give-toomuchrewardstouser", "45465-h-12-total-cds-deposited-amount-is-incorrectly-modified-when", "45463-h-10-users-can-withdraw-liquidated-collateral-sherlock-auton", "45464-h-11-borrower-withdrawing-at-a-loss-will-cause-losses-for-cd", "44374-h-4-users-can-modify-a-cancelled-order-withdrawing-the-same", "44378-h-8-insecure-calls-to-safetransferfrom-leads-to-users-tokens", "42062-enable-mode-can-be-frontrun-to-add-policies-for-a-different", "31275-failure-to-add-modified-facets-and-facets-with-modified-depe", "51371-exploiting-zero-amountoutmin-in-dexwrappers-for-mev-attacks", "26346-h-1-liquidatepartya-requires-signature-which-doesnt-have-non", "55633-h-01-payments-for-coupons-to-booster-are-irretrievable-0x52", "55634-h-02-bufferbinarypool-can-permanently-lock-funds-on-early-ex", "55637-h-05-closeanytime-timestamp-is-never-validated-against-prici", "55636-h-04-closeanytime-timestamp-is-never-validated-against-curre", "55635-h-03-market-direction-signature-can-be-abused-if-privatekeep", "24299-h-1-oracle-request-timestamp-and-pending-position-timestamp", "24302-h-4-pythoracleif-priceexpo-is-less-than-0-wrong-prices-will", "26299-insufficient-permissions-granted-to-new-auctions-sigmaprime", "26297-no-checks-for-non-zero-output-address-when-using-ecrecover-s", "43027-h-04-unstaking-does-not-update-the-mapping-sethuserclaimfork", "57634-eth-can-get-stuck-on-the-contract-zokyo-none-onemind-markdow", "57636-royalties-might-get-stuck-on-the-contract-zokyo-none-onemind", "57560-issues-with-token-transfers-and-rewards-when-a-marinator-is", "57533-user-funds-lock-in-mystaking-due-to-stakercount-manipulation", "57534-fee-can-be-applied-multiple-times-to-same-rewards-in-mystaki", "57531-stake-begin-time-updated-before-reward-calculation-in-mystak", "57532-incorrect-storage-of-user-rewards-during-staking-in-mystakin", "57521-reentrancy-in-main-functions-zokyo-none-trustswap-markdown", "24991-h-01-a-malicious-early-userattacker-can-manipulate-the-vault", "56420-staking-is-not-used-to-calculate-arkouda-tokens-to-be-reward", "56421-value-of-base-reward-state-variable-is-incorrect-zokyo-none", "56419-user-can-claim-rewards-before-the-start-zokyo-none-cwbc-mark", "42453-h-01-lack-of-access-control-on-assertgovernanceapproved-can", "17100-origin-token-migration-marketplace-reference", "56297-deposits-and-shares-may-get-stuck-zokyo-none-rainmaker-markd", "56308-reentrancy-attack-in-emergencywithdraw-function-zokyo-none-s", "42336-h-14-anyone-can-arbitrarily-mint-fungible-tokens-in-vaderpoo", "42335-h-13-anyone-can-arbitrarily-mint-synthetic-assets-in-vaderpo", "42333-h-02-redemption-value-of-synths-can-be-manipulated-to-drain", "16980-yield-v2-witch-buy-payall-no-auction", "65079-h-01-claim-allows-payouts-from-an-arbitrary-token-pool-not-t", "62971-partial-redemptions-can-be-used-to-steal-assets-cyfrin-none", "62972-accountableasyncredeemvaultfulfillredeemrequest-ignores-proc", "62970-critical-dos-in-queue-processing-if-async-cancellations-are", "62969-accountableasyncredeemvaultfulfillcancelredeemrequest-can-de", "38196-malicious-user-can-steal-flux-token-by-abusing-voterpoke-imm", "38189-lack-of-access-control-in-poke-function-allows-in-unlimited", "63178-h-12-missing-width-scaling-in-feewalkerup-non-visited-underc", "63170-h-4-uncollected-fees-from-users-nft-position-are-stuck-in-nf", "63937-c-01-anyone-can-re-initialize-the-swapproxy-pashov-audit-gro", "58097-c-02-wrong-usage-of-mapping-target-in-cancelredeemrequest-pa", "32467-attacker-can-stall-undelegations-openzeppelin-none-forta-sta", "63500-double-order-attack-via-callback-mechanism-mixbytes-none-bar", "63501-replay-attack-via-balance-based-nonce-mixbytes-none-barter-d", "20530-c-02-reentrancy-allows-any-user-allowed-even-one-free-honeyj", "61470-h-02-donated-tokens-are-never-deposited-into-vaults-pashov-a", "61468-c-01-incorrect-fee-due-to-double-subtracting-requestsumasset", "61457-h-04-malicious-users-may-block-other-withdrawals-pashov-audi", "61469-h-01-flawed-withdrawal-logic-when-caller-differs-from-share", "61478-h-01-getrate-ignores-szdecimals-pashov-audit-group-none-blue", "61454-h-01-unapproved-requests-are-not-deducted-from-total-assets", "61455-h-02-withdraw-check-can-be-bypassed-pashov-audit-group-none", "62809-h-2-users-voting-weight-can-be-double-counted-when-finalize", "63718-c-02-stakes-not-forwarded-post-delegation-positions-unwithdr", "64665-eligible-supply-is-not-reduced-on-late-entry-spearbit-none-b", "64666-totalexcludedsupply-drifts-from-reality-spearbit-none-buck-l", "64664-abi-struct-mismatch-in-band-config-spearbit-none-buck-labs-s", "56951-burve-incorrect-implementation-of-erc4626viewadjustor", "56955-burve-fee-bypass-in-valuefacet-removevaluesingle", "55209-c-02-incorrect-cumulativevalue-in-liqfacetaddliq-gives-less", "56952-burve-incorrect-netting-logic-leads-to-excessive-withdrawal-amounts", "56956-burve-noopvault-donation-attack-drains-assets-from-a-closure", "56957-h-8-valuefacetremovevaluesingle-will-withdraw-less-than-requ", "61950-c-01-carryvoteforward-enables-double-voting-pashov-audit-gro", "36310-c-01-withdrawing-collateral-and-fees-and-bypassing-trust-saf", "55503-c-02-pending-stake-not-accounted-for-in-liquidity-calculatio", "63357-h-01-malicious-users-can-brick-vault-operations-by-exploitin", "57953-h-01-incorrect-basket-usd-value-will-cause-incorrect-results", "62822-h-01-not-excluding-accruedprotocolfee-from-state-update-oper", "55092-crestal-network-anyone-approving-blueprintv5-can-drain-erc20-via-payment-paywitherc20", "61287-rebaseable-tokens-cause-unfair-vesting-and-claim-failures-", "41690-h-03-updatexp-can-be-omitted-during-liquidation-pashov-audit", "63542-c-02-withdrawal-requests-through-deposit-pool-lost-permanent", "63543-c-03-tvl-errors-by-including-pending-withdrawal-assets-pasho", "63546-h-03-scaling-error-in-elyasset-price-calculation-leads-to-fe", "63541-c-01-receivefromdepositpool-does-not-track-assets-transferre", "63544-h-01-tvl-double-counts-assets-returned-from-strategy-to-vaul", "63547-h-04-strategy-allocation-tracking-errors-affect-tvl-calculat", "59895-calling-withdrawforfeit-multiple-times-for-a-single-deposi", "62849-h-02-paid-tokens-by-smart-contract-wallets-are-not-refunded", "55523-double-counting-of-the-migrated-stake-mixbytes-none-euler-ma", "61788-attacker-can-lock-user-funds-through-redeem-function-openzep", "65649-fluid-processnormalsupplyaction-permits-an-uncapped-withdrawal", "61019-infinite-interest-rate-bug-immunefi-folks-finance-git", "55705-h-03-natural-logarithm-function-silently-accepts-invalid-non", "58127-c-01-decrease-position-can-be-abused-to-withdraw-pnl-twice-p", "40188-h-01-inconsistent-spread-and-price-impact-charges-pashov-aud", "58128-h-01-holding-fees-accounting-discrepancy-when-collateral-is", "53286-h-03-soulbound-tokens-cannot-be-minted-or-burnt-due-to-an-in", "64870-h-02-dust-orders-can-block-order-posting-code4rena-gte-gte-g", "64835-h-02-backstop-bid-side-frozen-by-tick-size-constraint-code4r", "64869-h-01-order-double-linked-list-is-broken-because-orderprevord", "64858-h-10-protocol-fails-to-charge-fees-from-swap-amount-code4ren", "63976-h-01-anyone-can-finalize-the-sale-early-via-testfinalizesett", "63977-h-02-the-finalizesettlement-can-be-dossed-leading-to-refund", "60149-all-funds-become-irredeemable-when-the-tree-is-halfway-pop", "60150-commitments-can-be-overwritten-by-overflowing-the-tree-qua", "63683-c-01-incorrect-reward-calculation-pashov-audit-group-none-hy", "63684-h-01-cross-contract-signature-replay-allows-users-to-inflate", "57739-h-02-insufficient-liquidity-checks-for-put-may-cause-exercis", "63922-h-01-deprecated-safeapprove-usage-blocks-collateral-approval", "57824-h-03-non-perpetual-locks-gaining-extra-delegation-power-pash", "59427-user-pending-rewards-can-never-be-paid-out-quantstamp-inte", "58706-h-01-payers-exploit-reentrantsettle-to-bypass-payments-with", "38491-h-03-activevalidatorcount-is-never-set-or-increased-pashov-a", "58611-h-03-deactivated-validator-retains-old-balance-after-reactiv", "58609-h-01-addrebalancerequest-may-use-outdated-balance-for-deleg", "58612-h-04-reportslashingevent-reverts-if-outdated-balance-is-belo", "58157-h-06-lack-of-access-control-in-clgauge-creation-allows-unaut", "58151-c-02-clgauge-sends-kitten-rewards-to-itself-instead-of-to-st", "61952-h-02-reward-rates-can-be-reset-to-0-and-future-rewards-can-b", "58154-h-03-externalbribeearned-skips-rewards-before-the-last-token", "58153-h-02-loss-of-claimable-rewards-upon-gauge-deactivation-pasho", "58207-c-03-incentive-rewards-may-be-stolen-pashov-audit-group-none", "61951-h-01-repeated-distributions-for-killed-gauges-can-block-vali", "58206-c-02-lack-of-lastmintedperiod-update-allows-unlimited-mintin", "61953-h-03-permissionless-voting-through-votercarryvoteforward-pas", "58155-h-04-duplicate-tokenid-in-delegate-list-may-inflate-votes-pa", "58010-c-01-split-can-be-abused-to-create-locked-data-with-an-arbit", "58208-h-01-votingreward-not-set-on-gauge-pashov-audit-group-none-k", "58379-lend-malicious-liquidator-can-liquidate-without-providing-collateral", "58384-lend-incorrect-distribution-of-lend-tokens-to-users", "58386-lend-liquidating-corerouter-can-cause-excess-borrower-loss", "58392-lend-cross-chain-collateral-is-miscalculated-in-borrowwithinterest", "58391-lend-liquidation-validation-logic-is-wrong", "58377-lend-cross-chain-liquidation-computes-maxliquidatable-incorrectly", "58388-lend-cross-chain-liquidation-reduces-debt-by-collateral-seized", "58381-lend-incorrect-lend-reward-distribution-for-cross-chain-borrows", "58374-lend-wrong-l-token-seize-amount-in-liquidatecrosschain", "58390-lend-borrower-can-redeem-collateral-immediately-after-borrowing", "58395-lend-cross-chain-debt-accrues-incorrectly", "58370-lend-repeated-claims-of-the-same-rewards-drain-lend-reserves", "58396-lend-corerouter-borrow-has-an-incorrect-collateral-check", "58376-lend-corerouter-redemption-payout-is-miscalculated", "58378-lend-supplying-uses-an-outdated-exchange-rate", "58375-lend-cross-chain-borrow-ignores-existing-debt-in-collateral-validation", "58383-lend-cross-chain-liquidation-uses-the-wrong-srctoken", "58393-lend-cross-chain-repayment-updates-the-wrong-borrow-balance", "58385-lend-cross-chain-repayment-updates-same-chain-borrow-balances", "58371-lend-protocol-reward-tokens-are-permanently-stuck", "58543-h-01-incorrect-vesting-interest-calculation-enables-mev-atta", "36354-h-14-incorrect-parameters-bricks-certain-functions-pashov-au", "65372-depositmanager-refundentryfee-doesnt-deduct-referral-rewards", "65376-depositmanagergetrewards-always-includes-referrer-fee-result", "62723-h-1-rebalancer-can-steal-funds-from-markets-by-sending-to-cu", "62716-h-01-full-restricted-users-can-still-deposit-kann-none-manif", "62715-c-01-first-deposit-can-result-in-zero-shares-due-to-direct-t", "58701-h-01-attackers-can-exploit-yield-distribution-through-onun", "65418-oracle-void-outcome-leaves-predictionmarketv3managerclobvoid", "63525-inability-to-claim-rewards-from-the-curve-gauge-mixbytes-non", "62486-h-5-migraterewardpool-fails-due-to-incompatible-storage-desi", "62694-arithmetic-overflow-in-getprice-when-feeds-return-large-valu", "62662-buffer-drainage-through-repeated-rebase-calls-due-to-stale-s", "42441-h-01-openlevv1libs-and-lpools-dotransferout-functions-call-n", "65201-h-03-lp-providers-will-not-get-liquidation-fee-most-times-pa", "65199-h-01-function-unlockdeposit-adds-discounted-assets-as-trader", "63445-h-01-stakers-may-fail-to-claim-all-incentives-pashov-audit-g", "65025-h-01-builderwallet-init-is-unprotectedre-initializable-enabl", "25724-h-08-nftfloororacles-asset-and-feeder-structures-can-be-corr", "65286-c-01-missing-authorization-in-withdraw-and-redeem-allows-the", "62866-expired-token-groups-not-synchronized-with-erc1155-balance-t", "58205-c-01-rebasereward-fails-because-of-incorrect-token-handling", "63402-h-02-borrowers-can-avoid-paying-interest-for-lenders-pashov", "63401-h-01-parameter-change-skews-getters-pashov-audit-group-none", "63781-updating-the-entity-allowance-when-the-individual-belongs-to", "63778-pending-payouts-when-resolving-an-investor-are-lost-because", "27331-h-01-custom-redemption-might-revert-if-old-assets-were-unreg", "27332-h-02-a-new-era-might-be-triggered-despite-a-significant-valu", "62187-h-01-transferfee-uses-an-incorrect-transfer-method-pashov-au", "62543-h-06-incorrect-pendingcounts-calculation-pashov-audit-group", "62541-h-04-dos-risk-from-pending-prize-locking-mechanism-pashov-au", "62542-h-05-currency-validation-missing-in-listing-and-offer-reques", "62594-h-01-missing-index-updates-in-burnpacketfrominventory-cause", "62539-h-02-insufficient-restrictions-in-instantopenpacket-risk-dos", "62544-h-07-spinlottery-will-break-if-the-first-prizeid-is-selected", "55113-h-03-incorrect-boost-management-leads-to-staking-reward-loss", "41365-h-01-signatures-can-be-replayed-using-different-addresses-pa", "62540-h-03-prize-locking-mechanism-inconsistency-with-weight-propo", "63599-c-02-checkpoints-are-almost-always-outdated-due-to-missing", "43026-h-02-rewards-of-giantmevandfeespool-can-be-locked-for-all-us", "65327-any-slasher-can-increase-another-ones-reveal-delays-cyfrin-n", "65322-any-staker-can-fully-avoid-slashing-by-triggering-oog-revert", "65324-malicious-actors-can-force-vaults-to-exit-if-they-wish-to-ge", "65326-anyone-can-dodge-reveal-delays-by-providing-unrelated-accoun", "65325-malicious-actors-can-get-free-rewards-if-contract-gets-pause", "64080-h-2-the-vault-can-be-drained-sherlock-steth-by-easedefi-git", "58248-h-04-lack-of-access-control-on-tsqds-registertokenonl2-pasho", "31547-h-02-computationunitsavailable-can-overestimate-number-of-av", "58245-h-01-missing-check-on-toblock-allows-distributors-to-change", "58247-h-03-workers-could-withdraw-without-deregister-and-waiting-f", "65495-h-01-missing-authorization-check-allows-unauthorized-fund-wi", "63420-h-2-attackers-will-steal-rewards-from-legitimate-pools-by-ma", "63419-h-1-users-with-pre-campaign-trades-will-drain-cashback-funds", "63075-malicious-actor-can-overwrite-others-user-state-via-1-wei-va", "63077-controller-and-receiver-cannot-redeem-shares-after-depositin", "63076-strategisthooksroot-permissions-may-be-circumvented-by-any-s", "63081-cancelled-redeem-requests-make-shares-permanently-unredeemab", "61235-timestamp-boundary-condition-causes-reward-dilution-for-ac", "61239-division-by-zero-in-rewards-distribution-can-cause-permane", "61233-incorrect-summation-of-curator-shares-in-claimundistribute", "63290-h-01-permissionless-sendcurrentoperatorskeys-pashov-audit-gr", "64975-direct-vault-deposits-incorrectly-counted-as-revenue-leading", "64973-redeem-nonce-mis-tracked-enables-replay-spearbit-none-tenbin", "64974-revenue-accounting-ignores-losses-spearbit-none-tenbin-pdf", "62638-c-01-withdrawal-calculation-causes-underflow-locking-all-use", "63508-requestredemption-reverts-because-l1btcredeemerwormholes-ban", "59721-vested-unclaimed-tokens-become-frozen-once-admin-revokes-t", "62524-infinite-loop-in-tick-iteration-due-to-misaligned-current-ti", "18535-h-3-depositfee-can-be-bypassed-via-deposit-queue-sherlock-no", "18534-h-2-earlier-users-in-rollover-queue-can-grief-later-users-sh", "19124-h-02-first-vault-depositor-can-steal-subsequent-depositors-t", "62756-h-01-pending-withdrawals-in-yuzuilp-contract-are-not-conside", "62758-h-03-fee-avoidance-possible-by-uncollected-fees-in-pool-acco", "59357-malicious-user-can-drain-rewards-through-reentrancy-in-sta", "63315-c-02-emptying-eth-from-zkpaysol-pashov-audit-group-none-sxt", "56710-potential-signature-replay-attack-in-erc1271handler-openzepp" ] }, "boilerplateRemoved": { "rootCause": [ "63167-ammplify-maker-spot-price", "63179-ammplify-malicious-pool", "62808-h-1-gas-consumed-in-notifyunsubscribe-is-underestimated-duri", "62811-h-4-finalize-window-vote-changing-vulnerability-auto-voters", "63046-h-2-caller-supplied-controltower-lets-anyone-be-the-migrator", "64082-h-4-owner-can-steal-funds-from-contract-by-calling-stakenxm", "64083-h-5-owner-can-hide-a-staked-nft-via-removetokenidatindex-and", "64081-h-3-owner-can-steal-funds-on-withdraw-by-burning-wrong-unisw", "63647-rwfx-undercollateralized-underflow", "62757-yuzu-nonatomic-updatepool", "62106-h-1-consensuschecksignatures-doesnt-check-duplication-of-sig", "62110-h-5-incorrect-performance-fee-calculation-in-feemanager-sher", "62111-h-6-redeems-through-redeemqueue-avoid-paying-management-and", "61872-resolv-self-transfer-rewards", "62487-h-6-dos-might-happen-to-dinerowithdrawrequestmanager-initiat", "62483-h-2-attacker-can-drain-the-entire-suppliers-on-morpho-market", "62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll", "62488-h-7-rewardmanagermixinclaimaccountrewards-lacks-of-necessary", "62593-c-02-missing-packet-id-in-finalizeopen-causes-nft-loss-pasho", "62647-chat-points-manipulation-by-adding-liquidity-to-custom-pools", "58397-h-28-subsequent-crosschain-borrows-dont-accrue-interest-on-e", "61480-blueberry-tvl-share-inflation", "63737-level-zero-heartbeat", "43733-h-2-fluidlocker-getunlockingpercentage-uses-540-instead-of-5", "61458-blueberry-approved-withdrawals", "43732-h-1-fluidlocker-getunlockingpercentage-incorrectly-divides-o", "65088-h-01-missing-signature-duplication-check-in-the-submitcheckp", "65091-h-04-an-attacker-can-overflow-the-count-of-messages-in-a-bot", "65092-h-05-incorrect-supply-fund-transferral-in-function-leave-can", "65093-h-06-reentrancy-in-function", "65094-h-07-incorrect-loop-indexing-in-libaddressstakingreleasescom", "65096-h-09-cross-msg-recipient-can-block-checkpoint-submission-cod", "55397-h-2-the-user-can-send-tokens-to-any-address-by-using-two-bri", "55396-h-1-mergetgt-has-no-handling-if-tgttoexchange-is-exceeded-du", "48699-abacus-clear-unused-bond", "48701-abacus-past-closure-adjustment", "48698-abacus-token-mapping", "48700-abacus-locked-ether-transfer", "57871-h-04-fee-theft-via-arbitrary-contract-impersonation-in-colle", "44334-eywa-escrow-reentrancy", "44337-eywa-poke-dos", "61079-folks-borrow-balance", "61051-folks-unlimited-loan-health", "61091-folks-liquidation-mixing", "31585-catalyst-tokenid-reconfiguration", "38492-karak-increase-balance-shares", "50685-mismatching-data-location-inheritance", "47890-opentrade-loan-validation", "57870-h-03-predictable-token-deployment-address-enables-liquidity", "38286-puffer-partial-withdrawal-failure", "51982-pyth-price-exponent-mismatch", "51984-pyth-missing-payable", "53453-h-01-excess-payment-when-plugin-owner-reduces-price-shieldif", "61396-h-01-session-key-can-be-consumed-by-unauthorized-scw-shieldi", "47980-switchboard-reward-manipulation", "44006-h-02-the-usdt-reward-claiming-functionality-of-vestedstaking", "44004-c-01-malicious-users-can-steal-all-staking-rewards-from-stak", "55233-h-6-attacker-can-exploits-batch-sender-role-to-block-result", "55229-h-2-malicious-validators-will-bypass-consensus-threshold-req", "45459-autonomint-cross-chain-price", "45461-autonomint-downside-dos", "45458-autonomint-excess-profit", "45457-autonomint-odos-data", "45456-autonomint-redeem-yields", "45460-autonomint-withdraw-accounting", "44375-h-5-attacker-can-drain-stoplimit-contract-funds-through-brac", "44372-h-2-attackers-can-drain-the-oracleless-contract-by-creating", "44373-h-3-lack-of-nonreentrant-modifier-in-fillorder-and-modifyord", "44371-h-1-unsafe-type-casting-in-token-amount-handling-sherlock-ok", "43530-axion-buyback-liquidity", "37916-h-02-griefing-attack-on-sellers-airdrop-benefits-code4rena-t", "32315-h-04-incorrect-approval-mechanism-breaks-all-magnetar-functi", "32312-h-01-magnetarmintxchainmodulesolmintbblendxchainsgl-can-be-u", "32317-h-06-attacker-can-use-magnetaractionoft-action-of-the-magnet", "32313-h-02-missing-check-on-helper-contract-allows-arbitrary-actio", "28948-h-1-liquidator-can-liquidate-user-while-increasing-user-posi", "28949-h-2-vault-leverage-can-be-increased-to-any-value-up-to-min-m", "35121-h-8-malicious-users-can-steal-reward-tokens-via-re-entrancy", "31192-h-3-reentrancy-in-vestingsolclaim-will-allow-users-to-drain", "27537-h-47-users-assets-can-be-stolen-when-removing-them-from-the", "24903-h-03-the-collect-function-will-always-transfer-zero-fees-los", "19123-yield-ninja-withdraw-accounting", "20308-zerem-unlock-exponent" ], "remediation": [ "63167-ammplify-maker-spot-price", "63179-ammplify-malicious-pool", "63046-h-2-caller-supplied-controltower-lets-anyone-be-the-migrator", "64082-h-4-owner-can-steal-funds-from-contract-by-calling-stakenxm", "64083-h-5-owner-can-hide-a-staked-nft-via-removetokenidatindex-and", "64081-h-3-owner-can-steal-funds-on-withdraw-by-burning-wrong-unisw", "63647-rwfx-undercollateralized-underflow", "62757-yuzu-nonatomic-updatepool", "62106-h-1-consensuschecksignatures-doesnt-check-duplication-of-sig", "62110-h-5-incorrect-performance-fee-calculation-in-feemanager-sher", "62111-h-6-redeems-through-redeemqueue-avoid-paying-management-and", "61872-resolv-self-transfer-rewards", "62487-h-6-dos-might-happen-to-dinerowithdrawrequestmanager-initiat", "61540-stakedcap-decimals-price", "61536-fee-auction-zero-assets", "61537-health-vs-slashable-collateral", "61528-inconsistent-balance-tracking-vault-dos", "61535-unvalidated-vault-address-interest-rate", "58397-h-28-subsequent-crosschain-borrows-dont-accrue-interest-on-e", "61480-blueberry-tvl-share-inflation", "63737-level-zero-heartbeat", "43733-h-2-fluidlocker-getunlockingpercentage-uses-540-instead-of-5", "61458-blueberry-approved-withdrawals", "43732-h-1-fluidlocker-getunlockingpercentage-incorrectly-divides-o", "48699-abacus-clear-unused-bond", "48701-abacus-past-closure-adjustment", "48698-abacus-token-mapping", "48700-abacus-locked-ether-transfer", "57871-h-04-fee-theft-via-arbitrary-contract-impersonation-in-colle", "44334-eywa-escrow-reentrancy", "44337-eywa-poke-dos", "61079-folks-borrow-balance", "61051-folks-unlimited-loan-health", "61091-folks-liquidation-mixing", "31585-catalyst-tokenid-reconfiguration", "38492-karak-increase-balance-shares", "50685-mismatching-data-location-inheritance", "47890-opentrade-loan-validation", "57870-h-03-predictable-token-deployment-address-enables-liquidity", "38286-puffer-partial-withdrawal-failure", "51982-pyth-price-exponent-mismatch", "51984-pyth-missing-payable", "53453-h-01-excess-payment-when-plugin-owner-reduces-price-shieldif", "61396-h-01-session-key-can-be-consumed-by-unauthorized-scw-shieldi", "47980-switchboard-reward-manipulation", "44006-h-02-the-usdt-reward-claiming-functionality-of-vestedstaking", "44004-c-01-malicious-users-can-steal-all-staking-rewards-from-stak", "55233-h-6-attacker-can-exploits-batch-sender-role-to-block-result", "55229-h-2-malicious-validators-will-bypass-consensus-threshold-req", "45459-autonomint-cross-chain-price", "45461-autonomint-downside-dos", "45458-autonomint-excess-profit", "45457-autonomint-odos-data", "45456-autonomint-redeem-yields", "45460-autonomint-withdraw-accounting", "44375-h-5-attacker-can-drain-stoplimit-contract-funds-through-brac", "44372-h-2-attackers-can-drain-the-oracleless-contract-by-creating", "44373-h-3-lack-of-nonreentrant-modifier-in-fillorder-and-modifyord", "44371-h-1-unsafe-type-casting-in-token-amount-handling-sherlock-ok", "43530-axion-buyback-liquidity", "28948-h-1-liquidator-can-liquidate-user-while-increasing-user-posi", "28949-h-2-vault-leverage-can-be-increased-to-any-value-up-to-min-m", "35121-h-8-malicious-users-can-steal-reward-tokens-via-re-entrancy", "31192-h-3-reentrancy-in-vestingsolclaim-will-allow-users-to-drain", "29664-low-level-call-missing-existence-check", "17856-degate-arbitrary-token-balance-check", "19123-yield-ninja-withdraw-accounting", "20308-zerem-unlock-exponent", "17097-origin-malicious-erc20-finalization-dos", "17095-origin-marketplace-repeated-withdraw", "18030-liquity-zero-icr-trove-removal" ], "attack": [ "65027-h-03-commission-fees-can-always-be-bypassed-code4rena-panopt", "65026-h-02-cross-contract-reentrancy-in-liquidation-enables-conver", "63167-ammplify-maker-spot-price", "63179-ammplify-malicious-pool", "62808-h-1-gas-consumed-in-notifyunsubscribe-is-underestimated-duri", "62811-h-4-finalize-window-vote-changing-vulnerability-auto-voters", "63046-h-2-caller-supplied-controltower-lets-anyone-be-the-migrator", "64082-h-4-owner-can-steal-funds-from-contract-by-calling-stakenxm", "64083-h-5-owner-can-hide-a-staked-nft-via-removetokenidatindex-and", "64081-h-3-owner-can-steal-funds-on-withdraw-by-burning-wrong-unisw", "63647-rwfx-undercollateralized-underflow", "62757-yuzu-nonatomic-updatepool", "62106-h-1-consensuschecksignatures-doesnt-check-duplication-of-sig", "62110-h-5-incorrect-performance-fee-calculation-in-feemanager-sher", "62111-h-6-redeems-through-redeemqueue-avoid-paying-management-and", "61872-resolv-self-transfer-rewards", "62487-h-6-dos-might-happen-to-dinerowithdrawrequestmanager-initiat", "62483-h-2-attacker-can-drain-the-entire-suppliers-on-morpho-market", "62485-h-4-when-users-borrow-directly-from-morpho-price-of-the-coll", "62488-h-7-rewardmanagermixinclaimaccountrewards-lacks-of-necessary", "62593-c-02-missing-packet-id-in-finalizeopen-causes-nft-loss-pasho", "62647-chat-points-manipulation-by-adding-liquidity-to-custom-pools", "58397-h-28-subsequent-crosschain-borrows-dont-accrue-interest-on-e", "61480-blueberry-tvl-share-inflation", "63737-level-zero-heartbeat", "43733-h-2-fluidlocker-getunlockingpercentage-uses-540-instead-of-5", "61458-blueberry-approved-withdrawals", "43732-h-1-fluidlocker-getunlockingpercentage-incorrectly-divides-o", "65088-h-01-missing-signature-duplication-check-in-the-submitcheckp", "65091-h-04-an-attacker-can-overflow-the-count-of-messages-in-a-bot", "65092-h-05-incorrect-supply-fund-transferral-in-function-leave-can", "65093-h-06-reentrancy-in-function", "65094-h-07-incorrect-loop-indexing-in-libaddressstakingreleasescom", "65096-h-09-cross-msg-recipient-can-block-checkpoint-submission-cod", "48699-abacus-clear-unused-bond", "48701-abacus-past-closure-adjustment", "48698-abacus-token-mapping", "48700-abacus-locked-ether-transfer", "57871-h-04-fee-theft-via-arbitrary-contract-impersonation-in-colle", "44334-eywa-escrow-reentrancy", "44337-eywa-poke-dos", "61079-folks-borrow-balance", "61051-folks-unlimited-loan-health", "61091-folks-liquidation-mixing", "31585-catalyst-tokenid-reconfiguration", "38492-karak-increase-balance-shares", "50685-mismatching-data-location-inheritance", "47890-opentrade-loan-validation", "57870-h-03-predictable-token-deployment-address-enables-liquidity", "38286-puffer-partial-withdrawal-failure", "51982-pyth-price-exponent-mismatch", "51984-pyth-missing-payable", "53453-h-01-excess-payment-when-plugin-owner-reduces-price-shieldif", "61396-h-01-session-key-can-be-consumed-by-unauthorized-scw-shieldi", "47980-switchboard-reward-manipulation", "44006-h-02-the-usdt-reward-claiming-functionality-of-vestedstaking", "44004-c-01-malicious-users-can-steal-all-staking-rewards-from-stak", "55233-h-6-attacker-can-exploits-batch-sender-role-to-block-result", "55229-h-2-malicious-validators-will-bypass-consensus-threshold-req", "45459-autonomint-cross-chain-price", "45461-autonomint-downside-dos", "45458-autonomint-excess-profit", "45457-autonomint-odos-data", "45456-autonomint-redeem-yields", "45460-autonomint-withdraw-accounting", "44375-h-5-attacker-can-drain-stoplimit-contract-funds-through-brac", "44372-h-2-attackers-can-drain-the-oracleless-contract-by-creating", "44373-h-3-lack-of-nonreentrant-modifier-in-fillorder-and-modifyord", "44371-h-1-unsafe-type-casting-in-token-amount-handling-sherlock-ok", "43530-axion-buyback-liquidity", "33495-h-08-incorrect-withdraw-queue-balance-in-tvl-calculation-cod", "28948-h-1-liquidator-can-liquidate-user-while-increasing-user-posi", "28949-h-2-vault-leverage-can-be-increased-to-any-value-up-to-min-m", "29347-h-01-incorrect-calculations-for-surplus-auction-creation-cau", "35121-h-8-malicious-users-can-steal-reward-tokens-via-re-entrancy", "31192-h-3-reentrancy-in-vestingsolclaim-will-allow-users-to-drain", "48951-h-12-dos-of-market-operations-with-malicious-offers-code4ren", "48954-h-15-the-last-borrowed-asset-will-not-be-collateralized-and", "48953-h-14-users-might-get-less-assets-than-expected-upon-migratio", "48952-h-13-when-opening-a-position-the-collateral-of-the-previous", "48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the", "48950-h-11-rubiconmarket-checks-slippage-incorrectly-code4rena-rub", "19123-yield-ninja-withdraw-accounting", "20308-zerem-unlock-exponent", "42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill", "24657-h-03-a-malicious-treasury-manager-can-burn-treasury-tokens-b" ], "preconditions": [ "64041-c-01-unrestricted-router-allows-unauthorized-merkle-root-set", "65027-h-03-commission-fees-can-always-be-bypassed-code4rena-panopt", "65026-h-02-cross-contract-reentrancy-in-liquidation-enables-conver", "64142-h-03-lp-pool-cap-may-be-exceeded-on-drawing-settlement-code4", "64079-h-1-attacker-can-profit-by-manipulating-uniswap-liquidity-sh", "64195-h-1-pool-managers-can-steal-all-other-pools-pending-deposits", "63167-ammplify-maker-spot-price", "63179-ammplify-malicious-pool", "64325-totalbalanceenforcer-validation-bypass-when-mixed-with-state", "63046-h-2-caller-supplied-controltower-lets-anyone-be-the-migrator", "64082-h-4-owner-can-steal-funds-from-contract-by-calling-stakenxm", "64083-h-5-owner-can-hide-a-staked-nft-via-removetokenidatindex-and", "64081-h-3-owner-can-steal-funds-on-withdraw-by-burning-wrong-unisw", "63647-rwfx-undercollateralized-underflow", "62757-yuzu-nonatomic-updatepool", "62106-h-1-consensuschecksignatures-doesnt-check-duplication-of-sig", "62110-h-5-incorrect-performance-fee-calculation-in-feemanager-sher", "62111-h-6-redeems-through-redeemqueue-avoid-paying-management-and", "61872-resolv-self-transfer-rewards", "62487-h-6-dos-might-happen-to-dinerowithdrawrequestmanager-initiat", "61540-stakedcap-decimals-price", "61536-fee-auction-zero-assets", "61537-health-vs-slashable-collateral", "61528-inconsistent-balance-tracking-vault-dos", "61535-unvalidated-vault-address-interest-rate", "58397-h-28-subsequent-crosschain-borrows-dont-accrue-interest-on-e", "61480-blueberry-tvl-share-inflation", "63737-level-zero-heartbeat", "43733-h-2-fluidlocker-getunlockingpercentage-uses-540-instead-of-5", "61458-blueberry-approved-withdrawals", "43732-h-1-fluidlocker-getunlockingpercentage-incorrectly-divides-o", "65088-h-01-missing-signature-duplication-check-in-the-submitcheckp", "65091-h-04-an-attacker-can-overflow-the-count-of-messages-in-a-bot", "65092-h-05-incorrect-supply-fund-transferral-in-function-leave-can", "65093-h-06-reentrancy-in-function", "65094-h-07-incorrect-loop-indexing-in-libaddressstakingreleasescom", "65096-h-09-cross-msg-recipient-can-block-checkpoint-submission-cod", "48699-abacus-clear-unused-bond", "48701-abacus-past-closure-adjustment", "48698-abacus-token-mapping", "48700-abacus-locked-ether-transfer", "57871-h-04-fee-theft-via-arbitrary-contract-impersonation-in-colle", "44334-eywa-escrow-reentrancy", "44337-eywa-poke-dos", "61079-folks-borrow-balance", "61051-folks-unlimited-loan-health", "61091-folks-liquidation-mixing", "31585-catalyst-tokenid-reconfiguration", "38492-karak-increase-balance-shares", "50685-mismatching-data-location-inheritance", "47890-opentrade-loan-validation", "57870-h-03-predictable-token-deployment-address-enables-liquidity", "38286-puffer-partial-withdrawal-failure", "51982-pyth-price-exponent-mismatch", "51984-pyth-missing-payable", "53453-h-01-excess-payment-when-plugin-owner-reduces-price-shieldif", "61396-h-01-session-key-can-be-consumed-by-unauthorized-scw-shieldi", "64682-h-02-blacklisted-operators-can-not-be-revoked-from-being-an", "47980-switchboard-reward-manipulation", "44006-h-02-the-usdt-reward-claiming-functionality-of-vestedstaking", "44004-c-01-malicious-users-can-steal-all-staking-rewards-from-stak", "55233-h-6-attacker-can-exploits-batch-sender-role-to-block-result", "55229-h-2-malicious-validators-will-bypass-consensus-threshold-req", "45459-autonomint-cross-chain-price", "45461-autonomint-downside-dos", "45458-autonomint-excess-profit", "45457-autonomint-odos-data", "45456-autonomint-redeem-yields", "45460-autonomint-withdraw-accounting", "44375-h-5-attacker-can-drain-stoplimit-contract-funds-through-brac", "44372-h-2-attackers-can-drain-the-oracleless-contract-by-creating", "44373-h-3-lack-of-nonreentrant-modifier-in-fillorder-and-modifyord", "44371-h-1-unsafe-type-casting-in-token-amount-handling-sherlock-ok", "43530-axion-buyback-liquidity", "33495-h-08-incorrect-withdraw-queue-balance-in-tvl-calculation-cod", "51369-withdrawals-are-blocked-due-to-wrong-function-name-on-the-cu", "51370-broken-stargate-deposit-flow-due-to-missing-allowance-halbor", "50682-unlimited-minting-by-reusing-failed-hyperlane-messages-halbo", "28948-h-1-liquidator-can-liquidate-user-while-increasing-user-posi", "28949-h-2-vault-leverage-can-be-increased-to-any-value-up-to-min-m", "29347-h-01-incorrect-calculations-for-surplus-auction-creation-cau", "35121-h-8-malicious-users-can-steal-reward-tokens-via-re-entrancy", "31192-h-3-reentrancy-in-vestingsolclaim-will-allow-users-to-drain", "48951-h-12-dos-of-market-operations-with-malicious-offers-code4ren", "48954-h-15-the-last-borrowed-asset-will-not-be-collateralized-and", "48953-h-14-users-might-get-less-assets-than-expected-upon-migratio", "48952-h-13-when-opening-a-position-the-collateral-of-the-previous", "48955-h-16-due-to-the-loss-of-precision-openposition-will-make-the", "48950-h-11-rubiconmarket-checks-slippage-incorrectly-code4rena-rub", "29664-low-level-call-missing-existence-check", "17856-degate-arbitrary-token-balance-check", "19123-yield-ninja-withdraw-accounting", "20308-zerem-unlock-exponent", "42730-h-02-acceptcounteroffer-may-result-in-both-orders-being-fill", "24657-h-03-a-malicious-treasury-manager-can-burn-treasury-tokens-b", "17097-origin-malicious-erc20-finalization-dos", "17095-origin-marketplace-repeated-withdraw", "18030-liquity-zero-icr-trove-removal" ], "impact": [ "51369-withdrawals-are-blocked-due-to-wrong-function-name-on-the-cu", "51370-broken-stargate-deposit-flow-due-to-missing-allowance-halbor", "50682-unlimited-minting-by-reusing-failed-hyperlane-messages-halbo" ] } }