Read the findings of the 2022 Web3 Security Report

Users can directly call all the public functions in collectors contract. However, according to the documentation，the user should call `cast` and the smart accounts would use NbnImplementationsM1 to cast the swap spell using the connector. 

Users can directly interact with functions in collectors 

In the contract `staking`, the role `owner` has the authority over the following function:
- setLockPeriodValues()
- removeLockPeriodValues()
- setMinlockPeriod()

Any compromise to the `owner` account may allow the hacker to take advantage of this, set/remove `LockPeriodValues` and set `minlockPeriod`. 

In the contract `Migrations`, the role `owner` has the authority over the following function:
- setCompleted()

Any compromise to the `owner` account may allow the hacker to take advantage of this and set `last_completed_migration`. 

In the contract `StorageOwners`, the role `owner` has the authority over the following function:
- changeStorageOracleStatus()
- activateStorageOracle()
- deactivateStorageOracle()

Any compromise to the `owner` account may allow the hacker to take advantage of this and change the status of `storageOracles[oracle]`. 

In the contract `StakingStorage`, the role `storageOracles` has the authority over the following function:
- CreateDepositorToDepositRecordIndexToRecordIDMapping()
- CreateStakingRecordMapping()
- UpdateStakingRecordMapping()
- CreateStakingRecordToDepositorMapping()

Any compromise to the `storageOracles` account may allow the hacker to take advantage of this, create `DepositorToDepositorRecordIndexMapping[depositor]`, create/update `StakingRecordMapping[StakingRecordId]` and create `depositorAddressMapping`. 

In the contract `StorageOwners`, the role `storageOracles` has the authority over the following function:
- reAssignStorageOracle()

Any compromise to the `storageOracles` account may allow the hacker to take advantage of this, deactivate `storageOracles[msg.sender]` and activate `storageOracles[newOracle]`. 

Centralization Risk

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. 
If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. 

Check-effect-interaction Pattern Violation

The `cast` function uses the msg.value variable in a loop. While processing token payments involved a separate transferFrom call for each loop iteration, processing ETH payments simply checked whether msg.value was sufficient, which allows the attacker to reuse the same ETH multiple times.

ref: https://samczsun.com/two-rights-might-make-a-wrong/

msg.value Reuse

There are multiple typos in the aforementioned files. The `cToken` should be `vToken`.  

Typo

The input parameter `getId` is never used in function `harvest()`. 

Unused parameter

The function `withdraw` utilizes `muint` as the basis to withdraw lp token. However, the function `deposit()` doesn't call `setUint()` store the uint, the function `withdraw()` and function `harvest()` doesn't call `setUint()` to update the uint. 

Inconsistency between `getUint()` and `setUint()`

Since the function `withdraw` utilizes `recordID` as the basis to withdraw tokens, the finding is minor. However, the function `deposit()` calls `setUint()` to store the uint, while the function `withdraw()` doesn't call `setUint()` to update the uint and causes the inconsistency. 

The input parameter `getId` is never used in function `withdraw()`. However, according to the documentation, the function should utilize `getId` to retrieve the uniAmt from muint. 

A sandwich attack might happen when an attacker observes a transaction swapping tokens or adding liquidity without setting restrictions on slippage or minimum output amount. The attacker can manipulate the exchange rate by frontrunning (before the transaction being attacked) a transaction to purchase one of the assets and make profits by backrunning (after the transaction being attacked) a transaction to sell the asset.

The following functions are called without setting restrictions on slippage or minimum output amount, so transactions triggering these functions are vulnerable to sandwich attacks, especially when the input amount is large:

- `deposit()`
- `withdraw()`

Potential Sandwich Attacks

The function `sell` never uses `getId`. However, according to the documentation, the function should utilize `getId` to retrieve the `unitAmt` from `muint`. 

When transferring standard ERC20 deflationary tokens, the input amount may not be equal to the received amount due to the charged transaction fee. As a result, an inconsistency in the amount will occur and the transaction may fail due to the validation checks.

Incompatibility With Deflationary Tokens(Swap)

If the connectors are deleted before the users withdraw all their money, the rest money won't be able to be retrieved. Any compromise to the `chief` and `master` accounts may allow a hacker to take advantage of this authority. 

Centralization Related Risks

`currentTimeStamp` is the value of block.timestamp, while `maturityDate` is the value of time period. Line 136 directly compares `currentTimeStamp` with `maturityDate`. 

Inconsistent Check

The implementation of function `changeStorageOracleStatus()` is the combination of functions `activateStorageOracle()` and `deactivateStorageOracle()`. 

Redundant Functions

Nubian

tokens.js

connectors.sol

mapping

registry

deployConnector.js

CoreStaking-master

memory.sol

helpers.sol

auth.json

basic.sol

deploy.js

deployAll.js

basic.json

package.json

venus

IStaking.sol

1_initial_migration.js

interface.sol

main.sol

7_deploy_Event.js

interfaces.sol

event.sol

basic.md

events.sol

sample-script.js

Nubian-dsa-connectors-master

truffle-config.js

implementation_default.v2.test.sol

enableConnector.js

proxy

test

Implementation_m1.sol

erc20.json

README.md

implementation_default.sol

Implementation_m2.test.sol

package-lock.json

list.sol

connectorsV2.json

venusEOA

deployContracts.js

BxdConnectorsV2.json

dsa-connectors

Readme.md

scripts

connectors

ownable.sol

maker.json

account.sol

nubian-dsa-contracts-master

VenusMappingController.sol

pancakeswap

math.sol

venusEOA.sol

StorageOwners.sol

abis

Migrations.sol

authority

autofarm

Phishing scammer Monkey Drainer has pilfered as much as $1M in Ethereum

Ethereum (ETH) Sees High Volatility as U.S. Records Higher-Than-Expected GDP Growth

BTC price struggles at $21K as trader says ‘top is in’ for Bitcoin, Ethereum

DeFi Analyst Predicts $2.00 Per Token For Both Uniglo.io And Ripple In 2023 | NewsBTC

3 reasons why it could be a rocky week for Bitcoin, Ethereum and altcoins

Ethereum rallies to $1,350, but derivatives metrics remain neutral to bearish

DeFi Exchange Mango's $114M Exploit Was 'Market Manipulation,' Not a Hack, Ex-FBI Special Agent Says

Bitcoin, Ethereum, Crypto News and Price Data - CoinDesk

Disney hiring transaction lawyer for ‘aggressive’ NFT and DeFi plans

How Ethereum based BudBlockz (BLUNT) Unites the Crypto and Marijuana Industries | NewsBTC

Gibraltar Will Focus on Stablecoins and DeFi Lending After Market Turmoil

FTX.US seems to have paused withdrawals on Ethereum hours after filing for bankruptcy

"Ethereum Killer" Solana's Top Spot Threatened by FTX Drama and Emergence of Strong Opponent

Most Hyped Cardano NFT Project Co-Signed by Legendary Ethereum Club

Brett Harrison raises $5 million for DeFi platform aimed at institutions: Bloomberg

Hacker Exploits BNB Chain-Based DeFi Protocol Ankr

Ethereum derivatives look bearish, but traders believe the ETH bottom is in

DeFi protocol Archimedes raises $4.9 million in seed funding

CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data

Nubian

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

15

0

4

0

11