Tokemak liquidity operator can steal funds
Intro Tokemak operates a liquidity farming strategy. The funds are held by Tokemak manager contract (here). For maintenance operations,...
top of page
Trust
security
Oct 4, 20223 min read
The story of the 0-day crit that wasn't
Yesterday I was taking a look at oasisDEX, a trading dApp from the MakerDAO team. With a 10-100K crit bounty on Immunefi and a team with...
Sep 22, 20221 min read
MED - Brahma.Fi - Wrong oracle used to calculate min slippage may cause loss of over 80% of rewards
Description Bug Description The harvester's harvest() function exchanges reward tokens to USDC. There is a bug in the following lines: if...
Sep 22, 20222 min read
MED - Brahma-Fi - Curve miscalculations may cause user withdraws to fail
Bug Description To pull funds from trade executors, in order to satisfy user withdrawls, initiateWithdraw() function is used. For Convex...
Sep 22, 20222 min read
CRIT - Brahma.Fi - L2 Position handler miscalculates position value leading to severe risks
Target https://optimistic.etherscan.io/address/0x1b6BF7Ab4163f9a7C1D4eCB36299525048083B5e Description Bug Description In...
Sep 22, 20222 min read
CRIT - Brahma.Fi - Fee collection does not take previous losses into account 🚩
Target https://etherscan.io/address/0x3c4Fe0db16c9b521480c43856ba3196A9fa50E08 Bug Description According to the docs (linked below) and...
Sep 22, 20221 min read
LOW - ANKR - User gets more gas than supposed to when distributing rewards
Target https://bscscan.com/address/0x66BEA595AEFD5a65799a920974b377Ed20071118 Bug Description The distributeRewards() which pays out...
Sep 22, 20222 min read
HIGH - Iron Bank - Collateral cap is not enforced at account initialization
Target https://etherscan.io/address/0x00e5c0774A5F065c285068170b20393925C84BF3 Bug Description One of the core invariants of the...
Sep 22, 20221 min read
HIGH - Iron Bank - Liquidator is not credited with correct collateral amount
Target https://etherscan.io/address/0x7e8844ea4c211a69ad9308ba0b6cdb3ea0bb2b05 Bug Description In seizeInternal(),...
Sep 22, 20222 min read
HIGH - ANKR/Stader - Reward distribution is vulnerable to MEV leading to theft of reward 🚩
ANKR and Stader for BNB are both liquid staking solutions for BSC. They are both vulnerable to the expoit detailed below. They have...
Sep 22, 20221 min read
CRIT - Compound - Liquidators may seize assets not held as collateral - Closed as known issue
Target https://github.com/compound-finance/compound-protocol/pull/127 Bug Description When borrower's liquidation becomes negative,...
Sep 22, 20221 min read
MED - Morpho Finance - Logic contract might be destructible via controlled delegatecall
Title: PositionsManager implementation contract state could be corrupted and possibly destructed. Target: https://etherscan.io/address/0x...
Sep 22, 20222 min read
Digging into a resurfaced nasty crypto scam 🚩
Web3 has secured its place as home of scammers, with a constant supply of new schemes and rotation of old ones. Today we’ll take a look...
Sep 22, 20221 min read
LOW - Polygon token-swap rounding error
Target https://wallet.polygon.technology Bug Description When using the https://wallet.polygon.technology/token-swap endpoint, the user...
Sep 22, 20225 min read
hxp2020 CTF - “EXCELlent”
Today we will be reversing a serial number validator written in EXCEL logic. First steps We receive an XLSX file and opening it in EXCEL...
Sep 22, 20226 min read
Hacklu 2019 Qualifiers - Yield 🚩
The challenge is an HTML file called index.html, which contains obfuscated and minified Javascript. When browsing the page we receive 34...
Sep 20, 20224 min read
HackLu 2019 Qualifiers - Futuristic communications
Communication in the future is a big thing. With the rising amount of data in the internet new handshake techniques are required. Here is...
Sep 20, 20227 min read
HackTM 2020 Qualifiers - Trip to trick 🚩
This deceptively simple challenge proved a great exercise in abusing FILE structs. Literally gifting you the entire libc of the process,...
Sep 20, 20222 min read
HackTM 2020 Qualifiers - Count on Me 🚩
Description: There is no description for the challenge. The zip file includes three resources: challenge.txt – gives us the encryption...
Sep 20, 20224 min read
HackTM 2020 Qualifiers - HackDex
The challenge starts by having 2 files: – hackdex, ELF file. – hacktm.hdex, text file. Description Considering your possible trip to...
bottom of page