-
Notifications
You must be signed in to change notification settings - Fork 28
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
farming-pool: min_lock_period has no upper-bound ceiling anywhere (unlike global_multiplier/credit_rate post-#89), letting an admin set an effectively permanent lock
farming-poolFarmingPool contractFarmingPool contractGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#132 In SmartDropLabs/smartdrop-contracts;factory: list_pools and get_pools_by_asset silently return a non-progressing pagination cursor when limit=0
correctnessLogic correctness and invariant enforcementLogic correctness and invariant enforcementfactoryFactory contractFactory contractGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26Third CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#131 In SmartDropLabs/smartdrop-contracts;farming-pool: no test proves set_global_multiplier has zero effect on the lock/position accrual path — the boost-only-applies-to-stake invariant is unverified
farming-poolFarmingPool contractFarmingPool contractGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26testingTests and test coverageTests and test coverageThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#130 In SmartDropLabs/smartdrop-contracts;vesting-wallet: no transfer_admin function at all — a lost admin key permanently and silently disables revoke() for the life of the schedule
GrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#129 In SmartDropLabs/smartdrop-contracts;factory: get_pools_by_asset's #83 fix caps the returned page size but not the scan itself — sparse/no-match queries still full-scan the entire registry
factoryFactory contractFactory contractGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26performanceGas cost and throughput improvementsGas cost and throughput improvementssecuritySecurity vulnerability or hardeningSecurity vulnerability or hardeningThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#127 In SmartDropLabs/smartdrop-contracts;farming-pool: unlike factory's enumerable pool registry + refresh_pool_ttls, there's no way to enumerate stakers/lockers or proactively refresh their TTL before archival
farming-poolFarmingPool contractFarmingPool contractGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26testingTests and test coverageTests and test coverageThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#126 In SmartDropLabs/smartdrop-contracts;vesting-wallet: compute_vested's unchecked multiplication can permanently brick release()/revoke()/every accessor, with no emergency-withdraw equivalent to recover the locked funds
bugSomething isn't workingSomething isn't workingcorrectnessLogic correctness and invariant enforcementLogic correctness and invariant enforcementGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#125 In SmartDropLabs/smartdrop-contracts;vesting-wallet: initialize() has an unguarded front-running window identical to the historical FarmingPool bug (#79)
bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#124 In SmartDropLabs/smartdrop-contracts;factory: transfer_admin is a single-step handoff with no confirmation, so one bad address permanently disables all future pool creation and WASM remediation
factoryFactory contractFactory contractGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#122 In SmartDropLabs/smartdrop-contracts;farming-pool: transfer_admin is a single-step handoff with no confirmation, so one bad address permanently bricks every admin-gated function including emergency_withdraw
farming-poolFarmingPool contractFarmingPool contractGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#121 In SmartDropLabs/smartdrop-contracts;farming-pool: set_min_stake_amount (and initialize) accept any i128 with no bounds, letting an admin silently freeze all deposits without pausing or emitting any event
correctnessLogic correctness and invariant enforcementLogic correctness and invariant enforcementfarming-poolFarmingPool contractFarmingPool contractGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26securitySecurity vulnerability or hardeningSecurity vulnerability or hardeningThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#120 In SmartDropLabs/smartdrop-contracts;farming-pool & factory: read-only query functions unconditionally perform TTL-bump storage writes, turning simulated-as-free reads into billable writes when composed in a real transaction
factoryFactory contractFactory contractfarming-poolFarmingPool contractFarmingPool contractGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardOfficial CampaignCampaign: Official CampaignCampaign: Official CampaignOfficial Campaign | FWC26Campaign: Official Campaign | FWC26Campaign: Official Campaign | FWC26performanceGas cost and throughput improvementsGas cost and throughput improvementsThird CampaignCampaign: Third CampaignCampaign: Third Campaignvery hardExtremely hard — deep expertise, careful design, and significant time requiredExtremely hard — deep expertise, careful design, and significant time requiredStatus: Open.#119 In SmartDropLabs/smartdrop-contracts;