SecurityLab / Reports / OPTIMISM🔍 providerAAVE
📍 0xCF11E554799DB755e670785dA9F9f5D8b9aE60eb · 🌐 OPTIMISM · 🤖 engine: heuristic
💰 Balance: 0.0 · 📈 Tx: 0
CRITICAL 11
HIGH 4
MEDIUM 2
LOW 8
Findings preview
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Oracle price manipulation (spot/TWAP/stale)
CRITICAL AMM pair reserve manipulation (privileged burn / sync)
CRITICAL Liquidation logic flaw (self-controlled borrower+taker)
HIGH Signature replay (missing nonce/cleanup)
HIGH Token mechanic incompatibility (deflationary/rebasing/fee-on-transfer)
HIGH Flash loan amplified attack
HIGH Insufficient input validation (arbitrary address/param)
MEDIUM Classic ERC20 approve without increase/decreaseAllowance
MEDIUM Decimals/precision mismatch between tokens
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
INFORMATIONAL Sensitive function without explicit access control
INFORMATIONAL Sensitive function without explicit access control
INFORMATIONAL Cross-chain bridge exploit (forged message / delegate hijack)
INFORMATIONAL Smart account vulnerability (ERC-4337/7579 init/signature)
INFORMATIONAL Reward accounting flaw (repeated claim / uncapped payout)
Preview only — no exploit details or fix recommendations are published here
to avoid disclosing an unpatched issue before the contract owner sees it. Full report (RU+EN), exact lines,
exploit path and fork PoC — via the bot below.
📩 Get full report via Telegram
View contract on block explorer →
⚠️ Think this finding is wrong?
If you're the contract owner and believe this automated finding is inaccurate,
or want this page reviewed or removed, send us your contact details and we'll get back to you.
Enable JavaScript to use this form, or message @mkoldaev on Telegram.