Skip to content

Issues: sherlock-audit/2024-08-morphl2-judging

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

247 Open 8 Closed
247 Open 8 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

Albort - Compounded Inflation in mintInflations Function
#247 opened Sep 23, 2024 by sherlock-admin2
Satanic_angel - _queueIndex is never emptied, so it can become quite large thus type-casting it to uint64 can lead to overflow
#246 opened Sep 23, 2024 by sherlock-admin4
bareli - no access control on executeProposal
#245 opened Sep 23, 2024 by sherlock-admin3
vlad - Owner can't remove stakers which doesn't withdraw funds
#244 opened Sep 23, 2024 by sherlock-admin2
HaxSecurity - L1Staking does not pay any messenger fee
#243 opened Sep 23, 2024 by sherlock-admin4
Albort - Index errors in pagination function
#242 opened Sep 23, 2024 by sherlock-admin3
Satanic_angel - calculateIntrinsicGasFee() method in L1messagequeuewithgaspriceoracle.sol will always overestimate the gas-price thus inflating the bridging cost for the users
#241 opened Sep 23, 2024 by sherlock-admin2
fat32 - L1Staking contract has Missing Protection against Signature Replay Attacks
#240 opened Sep 23, 2024 by sherlock-admin4
Satanic_angel - requestERC20() function in L1GatewayRouter would ideally never be called thus leading to DoS
#239 opened Sep 23, 2024 by sherlock-admin3
0xRajkumar - Attacker Can Harm Other Delegator by Strategic Delegating and UnDelegating
#238 opened Sep 23, 2024 by sherlock-admin2
Rea - Unrestricted withdrawal mechanism
#237 opened Sep 23, 2024 by sherlock-admin4
Albort - Initialization and state update issues
#236 opened Sep 23, 2024 by sherlock-admin3
0xNoodle - Centralized Control Over Token Mapping in updateTokenMapping Leading to Potential Compromise in L1ERC721Gateway Contract
#235 opened Sep 23, 2024 by sherlock-admin2
bareli - wrong verification in revertBatch
#234 opened Sep 23, 2024 by sherlock-admin4
Rea - Potential DoS on removeStakers()
#233 opened Sep 23, 2024 by sherlock-admin3
0xcoinymous - Inability to Challenge Malicious Batches After Protocol Pause Exceeds ChallengeWindow
#232 opened Sep 23, 2024 by sherlock-admin2
n4nika - L1USDCGateway.sol::burnAllLockedUSDC will not work since the gateway is not a minter in the USDC contract
#231 opened Sep 23, 2024 by sherlock-admin4
n4nika - Missing calls to _disableInitializers in multiple upgradeable contracts allows attacker to frontrun initialization
#230 opened Sep 23, 2024 by sherlock-admin3
0xNoodle - Unbounded Batch Size in finalizeBatchWithdrawERC721 Leading to Potential Out-of-Gas Errors and Denial of Service (DoS)
#229 opened Sep 23, 2024 by sherlock-admin2
0xlookman - During a withdraw in L1Staking.sol when a user is not able to claim his amount before the withdrawalLockBlocks, Eth will forever be locked in this contract.
#228 opened Sep 23, 2024 by sherlock-admin4
0xNoodle - Unbounded Growth in Batch Deposit Leading to Potential Denial of Service (DoS) in batchDepositERC721 Function
#227 opened Sep 23, 2024 by sherlock-admin3
Rea - Improper input validation on updateSequencerSetMaxSize()
#226 opened Sep 23, 2024 by sherlock-admin2
onthehunt - unclaimed[delegator].unclaimedStart[delegatee] = effectiveEpoch; will be incorrectly set in notifyDelegation() in the specified order
#225 opened Sep 23, 2024 by sherlock-admin4
0xRajkumar - Delegating Stake Without Claiming Reward Causes Loss
#224 opened Sep 23, 2024 by sherlock-admin3
n4nika - The arbitrary calls in the cross-comain messengers allow anyone to drain them
#223 opened Sep 23, 2024 by sherlock-admin2
ProTip! Adding no:label will show everything without a label.