Summary

• Home
• Math & Accounting
  • attacker balance gain
  • ether token leaking
  • explicit balance checks
  • incorrect calculation of token transfer
  • incorrectly payable
  • rounding errors
  • slippage parameter missing or ineffective
  • token loss
  • token oversupply by repayment without burn
• Oracle & State
  • bad randomness
  • block attributes misuse
  • improper missing l2 sequencer check
  • improper use of oracle heartbeats
  • incorrect nonce update signature replay attack
  • invalid state manipulation
  • missing improper check on oracle data
  • stale price risk
  • uninitialized storage vulnerabilities
  • unsafe use of tx origin
• Control Flow & Misc
  • attacker controlled delegatecall
  • attacker invokable self destruct
  • conflicting inheritance
  • denial of service
  • erroneous writing to memory instead of storage
  • gas limit manipulation possible by 1 64 rule
  • hashing consecutive variable length arguments
  • incorrect function visibility
  • keccak unequal memory lengths
  • missing improper check on the admin address
  • misuse of create2 opcode
  • property violation
  • reentrancy
  • self destruct
  • typographical errors
  • unchecked return values
  • unprotected external calls
  • unsafe delegatecall
  • unsafe unicode characters
  • use of assembly
  • validation check does not fall through