SecurityLab / Reports / SCROLL🔍 ScrollSettler
📍 0x6Ca700F2E24e216A3aF7c2Ed847F9268d5A83918 · 🌐 SCROLL · 🤖 engine: heuristic
💰 Balance: 0.0 · 📈 Tx: 0
CRITICAL 5
HIGH 3
MEDIUM 11
LOW 9
Findings preview
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Reentrancy with ETH withdrawal (repeated entry)
CRITICAL Oracle price manipulation (spot/TWAP/stale)
CRITICAL Smart account vulnerability (ERC-4337/7579 init/signature)
HIGH Signature replay (missing nonce/cleanup)
HIGH Token mechanic incompatibility (deflationary/rebasing/fee-on-transfer)
HIGH Transfer logic flaw (custom hook / fee-on-transfer desync)
MEDIUM Outdated Solidity compiler version
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM unchecked block — arithmetic without overflow protection
MEDIUM Classic ERC20 approve without increase/decreaseAllowance
MEDIUM Decimals/precision mismatch between tokens
LOW Floating compiler version (^ or >=)
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
LOW Logic depends on block.timestamp
INFORMATIONAL AMM pair reserve manipulation (privileged burn / sync)
INFORMATIONAL Insufficient input validation (arbitrary address/param)
Preview only — no exploit details or fix recommendations are published here
to avoid disclosing an unpatched issue before the contract owner sees it. Full report (RU+EN), exact lines,
exploit path and fork PoC — via the bot below.
📩 Get full report via Telegram
View contract on block explorer →
⚠️ Think this finding is wrong?
If you're the contract owner and believe this automated finding is inaccurate,
or want this page reviewed or removed, send us your contact details and we'll get back to you.
Enable JavaScript to use this form, or message @mkoldaev on Telegram.