SecurityLab / Reports / SCROLL🔍 MinimalForwarder
📍 0xAB98CD0e04Bb1FCd6320611fCAD6a7e534d8B302 · 🌐 SCROLL · 🤖 engine: heuristic
💰 Balance: 0.0 · 📈 Tx: 0
CRITICAL 11
HIGH 1
MEDIUM 7
LOW 6
Findings preview
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Sensitive function without explicit access control
CRITICAL Sensitive function without explicit access control
CRITICAL Cross-chain bridge exploit (forged message / delegate hijack)
HIGH Insufficient input validation (arbitrary address/param)
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM Classic ERC20 approve without increase/decreaseAllowance
MEDIUM Signature replay (missing nonce/cleanup)
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
INFORMATIONAL Sensitive function without explicit access control
INFORMATIONAL Sensitive function without explicit access control
INFORMATIONAL AMM pair reserve manipulation (privileged burn / sync)
INFORMATIONAL Token mechanic incompatibility (deflationary/rebasing/fee-on-transfer)
INFORMATIONAL Flash loan amplified attack
Preview only — no exploit details or fix recommendations are published here
to avoid disclosing an unpatched issue before the contract owner sees it. Full report (RU+EN), exact lines,
exploit path and fork PoC — via the bot below.
📩 Get full report via Telegram
View contract on block explorer →
⚠️ Think this finding is wrong?
If you're the contract owner and believe this automated finding is inaccurate,
or want this page reviewed or removed, send us your contact details and we'll get back to you.
Enable JavaScript to use this form, or message @mkoldaev on Telegram.