-
Notifications
You must be signed in to change notification settings - Fork 28
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
- Status: Open.#190 In SPulse-Org/SPulse-Contract;
[CRITICAL]
AccumulatedFeesis a global fungible pool with no per-market provenance — cross-market contamination on cancelaccountingAccounting / fee logicAccounting / fee logiccriticalCritical severity - funds at riskCritical severity - funds at riskGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSprediction-marketPrediction market contractPrediction market contractThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#178 In SPulse-Org/SPulse-Contract;[CRITICAL]
resolve_marketlets resolver sweep entire pool to fees by resolving to empty sidecriticalCritical severity - funds at riskCritical severity - funds at riskGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSprediction-marketPrediction market contractPrediction market contractsecuritySecurity vulnerabilitySecurity vulnerabilityThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#177 In SPulse-Org/SPulse-Contract;[CRITICAL]
register_referraldoesn't validate that the referrer is registered — unregistered referrers get paidcriticalCritical severity - funds at riskCritical severity - funds at riskGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSprediction-marketPrediction market contractPrediction market contractreferralReferral registry contractReferral registry contractThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#176 In SPulse-Org/SPulse-Contract;[CRITICAL] Configuration parameter interactions create hidden systemic risks — no safe combination of constants exists
criticalCritical severity - funds at riskCritical severity - funds at riskdesign-flawArchitectural design flawArchitectural design flawGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#175 In SPulse-Org/SPulse-Contract;[CRITICAL] Persistent storage TTLs can expire before claims/refunds — user funds permanently locked
criticalCritical severity - funds at riskCritical severity - funds at riskGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSprediction-marketPrediction market contractPrediction market contractThird CampaignCampaign: Third CampaignCampaign: Third Campaignttl-storageTTL / storage lifecycleTTL / storage lifecycleStatus: Open.#174 In SPulse-Org/SPulse-Contract;[CRITICAL]
set_configcan re-point market to malicious contracts — total fund theftcriticalCritical severity - funds at riskCritical severity - funds at riskGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSprediction-marketPrediction market contractPrediction market contractsecuritySecurity vulnerabilitySecurity vulnerabilityThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#173 In SPulse-Org/SPulse-Contract;[CRITICAL]
withdraw_feeslets fee recipient drain entire accumulator — no cap, no provenanceaccountingAccounting / fee logicAccounting / fee logiccriticalCritical severity - funds at riskCritical severity - funds at riskGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSsecuritySecurity vulnerabilitySecurity vulnerabilityThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#172 In SPulse-Org/SPulse-Contract;[CRITICAL] No pause/circuit-breaker mechanism — cannot halt system in emergency
criticalCritical severity - funds at riskCritical severity - funds at riskGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSShardExtremely difficult to resolveExtremely difficult to resolvesecuritySecurity vulnerabilitySecurity vulnerabilityThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#171 In SPulse-Org/SPulse-Contract;[CRITICAL] No upgrade coordination between contracts — independent upgrades break cross-contract ABI
criticalCritical severity - funds at riskCritical severity - funds at riskcross-contractCross-contract interactionCross-contract interactionGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSThird CampaignCampaign: Third CampaignCampaign: Third CampaignupgradeabilityUpgrade / admin controlUpgrade / admin controlStatus: Open.#170 In SPulse-Org/SPulse-Contract;[CRITICAL] Payout rounding leaves dust permanently trapped in the contract — sum of payouts never equals the pool
accountingAccounting / fee logicAccounting / fee logiccriticalCritical severity - funds at riskCritical severity - funds at riskGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSprediction-marketPrediction market contractPrediction market contractThird CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#169 In SPulse-Org/SPulse-Contract;[CRITICAL]
upgrade()allows arbitrary WASM replacement with no timelock, delay, or multi-sig — single compromised admin key = total losscriticalCritical severity - funds at riskCritical severity - funds at riskGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSsecuritySecurity vulnerabilitySecurity vulnerabilityThird CampaignCampaign: Third CampaignCampaign: Third CampaigntokenPULSE token contractPULSE token contractupgradeabilityUpgrade / admin controlUpgrade / admin controlStatus: Open.#168 In SPulse-Org/SPulse-Contract;