Jack marz-hunter

Stale Validator Schedule in claim2EVM Allows Retired Validators to Forge Claims and Drain the Bridge

Summary

The claim2EVM() function in UltraBridge.sol accepts claim signatures from any historical validator schedule, including schedules whose validators have been explicitly removed through rotation. There is no mechanism to expire, invalidate, or time-bound old schedules. If threshold validator keys from any retired schedule are compromised after rotation, an attacker can forge arbitrary claim transactions with fabricated counter values and drain all bridged tokens. The bridge currently holds 477,562 UOS (~$17,800) and has undergone 4 schedule rotations. The original 3 validators from Schedule 1 were removed in Schedule 4, yet they can still sign valid claims using schedule_id=1.

Finding Description

The UltraBridge contract implements a validator-signed bridge between Ultra blockchain and Ethereum. Validators sign ultra2evmData payloads that encode swap details (counter, amount, token,

Description

Summary

The PersistOrderRemovalToState function in x/clob/keeper/process_operations.go has six order removal reasons with their stateful validation entirely commented out or missing, marked with TODO(CLOB-877). During ProcessProposal, validators only run stateless validation (ValidateBasic) which checks that the order is stateful and the removal reason is specified — but does NOT verify whether the reason is actually valid. During DeliverTx, the stateful validation that should verify the removal reason is commented out. This enables any block proposer to remove arbitrary stateful orders from the on-chain orderbook without any validator being able to detect the fraud. A proposer can prevent their own liquidations, censor competitor orders, and extract MEV with zero detection risk.

Finding Description

The dYdX v4 CLOB (Central Limit Order Book) module processes block-level operations — order matches, liquidations, and order removals — through a proposer-submitted `MsgPro

Summary

The _processFeedResponses() function in PriceFeed.sol (lines 171-173) decodes and uses the share price from LST tokens without any bounds validation. A malicious or compromised LST token returning zero share price causes all collateral to appear worthless (triggering mass liquidations), while an inflated share price allows attackers to borrow unlimited USBD against minimal collateral. This vulnerability can result in complete protocol insolvency.

Finding Description

The Bima Protocol supports LST (Liquid Staking Token) collaterals that have exchange rates with their underlying assets. The PriceFeed fetches these exchange rates via sharePriceSignature calls.

The vulnerability exists at lines 171-173:

Summary

The _calcEthPrice() function in PriceFeed.sol (line 194-197) recursively calls fetchPrice(address(0)) to get the ETH/USD price for ETH-indexed tokens. If the ETH oracle (address(0)) is misconfigured as ETH-indexed, this creates infinite recursion and complete DoS. Additionally, ETH oracle downtime causes cascading failures for ALL ETH-indexed collateral types, creating a single point of failure that can freeze the entire protocol.

Finding Description

The Bima Protocol supports ETH-indexed collateral tokens where the base price is denominated in ETH rather than USD. To convert these prices, _calcEthPrice() fetches the ETH/USD price by calling fetchPrice(address(0)).

The vulnerability exists at lines 194-197:

Summary

The _isValidResponse() function in PriceFeed.sol does not validate Chainlink's answeredInRound parameter against roundId (lines 221-228). This allows stale oracle prices to be accepted as valid when answeredInRound < roundId, which occurs during oracle disputes or network issues. Attackers can exploit stale prices to open undercollateralized positions or trigger unfair liquidations, with potential losses of 6-10% of TVL during price discrepancy events.

Finding Description

The Bima Protocol relies on Chainlink oracles for price data. Chainlink's latestRoundData() returns multiple values including roundId and answeredInRound. According to Chainlink best practices, a price is considered stale if answeredInRound < roundId, indicating the answer was carried over from a previous round.

The vulnerability exists in the _isValidResponse() function at lines 221-228:

Summary

The _processFeedResponses() function in PriceFeed.sol uses abi.encode() instead of abi.encodeWithSelector() when making external calls to fetch share prices from LST tokens (line 171). This produces 32 bytes of malformed calldata instead of the required 4-byte function selector, causing all share price lookups to fail. As a result, the Bima Protocol cannot support yield-bearing Bitcoin LST tokens like wrapped staked BTC derivatives, completely blocking core protocol functionality.

Finding Description

The Bima Protocol is a Liquity-fork CDP lending protocol that allows users to deposit Bitcoin LSTs as collateral to mint USBD stablecoin. To support derivative tokens with exchange rates (like wstETH, rETH, etc.), the PriceFeed contract has a sharePriceSignature mechanism to fetch the share price from the token contract.

The vulnerability exists at line 171 in PriceFeed.sol:

Summary

The _sharesByQuote() function in UFarmPool.sol at lines 809-811 contains the classic ERC4626 vault inflation vulnerability. When a pool has zero total supply, the first depositor can deposit 1 wei to receive 1 share, then donate a large amount directly to the contract to inflate the share price. Subsequent depositors receive 0 shares due to integer division rounding down, and the attacker withdraws all funds. An attacker can steal 100% of any victim's deposit with minimal capital at risk.

Finding Description

The UFarm Digital protocol implements share-based accounting for pool deposits through the _sharesByQuote() function. The vulnerability exists because:

The share calculation has no virtual shares offset:

Summary

The frxETHMinter contract contains multiple centralization risks that allow the contract owner to unilaterally extract all user-deposited ETH. The owner can: (1) set withholdRatio to 100%, preventing ETH from reaching validators, (2) withdraw all withheld ETH via moveWithheldETH(), and (3) withdraw all contract ETH via recoverEther(). These functions have no timelock, multisig requirement, or governance oversight, creating a single point of failure where a compromised owner key leads to total fund loss.

Finding Description

Vulnerability 1: withholdRatio Can Be Set to 100%

Location: frxETHMinter.sol:165

Summary

The sfrxETH vault is vulnerable to read-only reentrancy attacks that can affect external protocols using pricePerShare() or convertToAssets() as price oracles. During withdraw() or redeem() operations, if the underlying token (frxETH) triggers callbacks, external protocols querying the vault's price functions will see stale/incorrect values. This can lead to unfair liquidations, arbitrage opportunities, or price manipulation in integrated protocols.

Finding Description

The vulnerability exists because state updates and external calls are not atomic, and view functions can be called during callbacks:

In sfrxETH.sol: