Non-Solo 127

  1. [H-01] Reliance on lifiData.receivingAssetId can cause loss of funds
  2. [H-02] All swapping functions lack checks for returned tokens
  3. [H-01] Users can lose value in emergency state
  4. [H-01] Users can get unlimited votes
  5. [H-02] VotingEscrow’s merge and withdraw aren’t available for approved users
  6. [H-03] [WP-H0] Fake balances can be created for not-yet-existing ERC20 tokens, which allows attackers to set traps to steal funds from future users
  7. [H-03] User rewards stop accruing after any _writeCheckpoint calling action
  8. [H-01] Avoidance of Liquidation Via Malicious Oracle
  9. [H-02] The return value success of the get function of the INFTOracle interface is not checked
  10. [H-03] Critical Oracle Manipulation Risk by Lender
  11. [H-04] Lender is able to seize the collateral by changing the loan parameters
  12. [H-05] Mistake while checking LTV to lender accepted LTV
  14. [H-01] Malicious Users Can Duplicate Protocol Earned Yield By Transferring wCVX Tokens To Another Account
  15. [H-01] Wrong timing of check allows users to withdraw collateral without paying for the debt
  16. [H-01] Hard-coded slippage may freeze user funds during market turbulence
  17. [H-02] The check for value transfer success is made after the return statement in _withdrawFromYieldPool of LidoVault
  18. [H-01] Can force borrower to pay huge interest