---
# System prepended metadata

title: '[2023-04-Rubicon] Presorting'

---

# [2023-04-Rubicon] Presorting 

**Contest repo:** https://github.com/code-423n4/2023-04-rubicon
**Findings repo:** https://github.com/code-423n4/2023-04-rubicon-findings
**Judging by:** [Hickuphh3](https://twitter.com/@HickupH) (Discord: `hickuphh3#4268`)
**Pre-sorting by:** [sorryNotsorry](https://twitter.com/0xSorryNotSorry) (Discord: `sorryNotsorry#1586`)




# High Severity Primary Submissions (76)
## [[H-1364]  Rewards can be claimed from Comptroller without justification](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1364)			
## [[H-1353]  Automatic matching allows front running offers forcing the maker to pay fees instead of earning them](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1353)			
## [[H-1313]  BathBuddy.getReward should update rewards from all reward tokens](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1313)			
## [[H-1299]  `take` doesn't take the whole offer in `RubiconMarket`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1299)			
## [[H-1294]  Leverage _Limit Calculation Vulnerability Due to Collateral Factor in _borrowLimit Function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1294)			
## [[H-1283]  Unused amount of ERC20 token by target contract will be lost in `FeeWrapper`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1283)			
## [[H-1281]  Orders created in RubiconMarket V1 will send dust to address(0)](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1281)			
## [[H-1279]  Reward accounting is incorrect in BathBuddy contract](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1279)			
## [[H-1277]  Lack of `swap` consideration, while calculating number of iteration (lend=>borrow=>swap) needs to be performed leads to incorrect iteration number](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1277)			
## [[H-1256]  _borrowLimit will return wrong iteration count](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1256)			
## [[H-1251]  `Position.closePosition` fails when maker fee is big enough.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1251)			
## [[H-1219]  order in parameters of `openPosition` are incorrect  when called in `buyAllAmountWithLeverage`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1219)			
## [[H-1218]  Position `_maxBorrow` does not check for market liquidity limit](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1218)			
## [[H-1212]  Wrong use of block.number on optimism leads to wrong interest calculations and user may end up paying alot of interest or unable to close leverage position.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1212)			
## [[H-1184]  Reward token will be lost when leftover tokens are different from the new duration rewards tokens](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1184)			
## [[H-1179]  No access control on `del_rank()` function resulting on deletion of any arbitrary id](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1179)			
## [[H-1156]  User can do an first deposit inflation attack on bathToken and can take away all the shares and rewards too.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1156)			
## [[H-1124]  Leveraged position can be frontrunned due to lack of limit price and slippage control](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1124)			
## [[H-1122]  Integer overflow/underflow vulnerability in Rubicon smart contract.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1122)			
## [[H-1110]  Manipulation of Offer Position in Sorted List](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1110)			
## [[H-1052]  RubiconMarket batchOffer and batchRequote make offers as self; complete loss of funds for some types of tokens, for example WETH](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1052)			
## [[H-1021]  Position doesn't distribute rewards to users](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1021)			
## [[H-1017]  Part of collateral assets is not taken into account when calculating the borrow amount](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1017)			
## [[H-986]  RubiconMarket.sol: offers aren't set properly due to  precision loss in `_matcho` function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/986)			
## [[H-959]  Debt + Interest in calculated wrong in _calculateDebt() in Position.sol](https://github.com/code-423n4/2023-04-rubicon-findings/issues/959)			
## [[H-956]  Opening and instantly closing a Position leads to profit](https://github.com/code-423n4/2023-04-rubicon-findings/issues/956)			
## [[H-945]  Funds can be stolen from market contract using reentrancy](https://github.com/code-423n4/2023-04-rubicon-findings/issues/945)			
## [[H-943]  Use of certain ERC20 tokens leads to trapped funds](https://github.com/code-423n4/2023-04-rubicon-findings/issues/943)			
## [[H-935]  batchRequote() function is missing few important validations on the function inputs](https://github.com/code-423n4/2023-04-rubicon-findings/issues/935)			
## [[H-905]  Reward truncation due to precision loss in BathBuddy contract](https://github.com/code-423n4/2023-04-rubicon-findings/issues/905)			
## [[H-903]  Calling `Position._marketBuy` and `Position._marketSell` functions that calculate `_fee` by dividing by `10000` can cause incorrect calculations](https://github.com/code-423n4/2023-04-rubicon-findings/issues/903)			
## [[H-902]  Incorrect calculations can occur when calling `Position._marketBuy` and `Position._marketSell` functions that do not include maker fee in `_fee`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/902)			
## [[H-897]  Calling `Position._marketSell` function can charge too much fee](https://github.com/code-423n4/2023-04-rubicon-findings/issues/897)			
## [[H-896]  Increase of `IERC20(myBathTokenBuddy).totalSupply()` can cause user's unclaimed rewards to drop](https://github.com/code-423n4/2023-04-rubicon-findings/issues/896)			
## [[H-876]  [H-03]  Incorrect value provided by price oracle can lead to overestimation and underestimation of the maximum borrable amount](https://github.com/code-423n4/2023-04-rubicon-findings/issues/876)			
## [[H-827]  [H-3] Using max borrow can increase the liquidation risk for traders](https://github.com/code-423n4/2023-04-rubicon-findings/issues/827)			
## [[H-825]  [H-2] Incorrect decimals in _maxBorrow function can cause over or under borrowing](https://github.com/code-423n4/2023-04-rubicon-findings/issues/825)			
## [[H-821]  Offers made by make() function in RubiconMarket contract can never be cancelled](https://github.com/code-423n4/2023-04-rubicon-findings/issues/821)			
## [[H-813]  RubiconMarket.sol _hide() can DOS due to out of gas](https://github.com/code-423n4/2023-04-rubicon-findings/issues/813)			
## [[H-812]  _borrowLimit would return less due to slippage](https://github.com/code-423n4/2023-04-rubicon-findings/issues/812)			
## [[H-770]  An attacker can steal all `RubiconRouter` funds](https://github.com/code-423n4/2023-04-rubicon-findings/issues/770)			
## [[H-767]  An attacker can steal all tokens of users that use `FeeWrapper`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/767)			
## [[H-766]  Some offers can't be cancelled](https://github.com/code-423n4/2023-04-rubicon-findings/issues/766)			
## [[H-720]  Maker and Fee recipient do not receive all funds from Taker](https://github.com/code-423n4/2023-04-rubicon-findings/issues/720)			
## [[H-702]  Cannot close leveraged positions](https://github.com/code-423n4/2023-04-rubicon-findings/issues/702)			
## [[H-666]  RubiconMarket checks slippage incorrectly](https://github.com/code-423n4/2023-04-rubicon-findings/issues/666)			
## [[H-644]  DOS of market operations with malicious offers](https://github.com/code-423n4/2023-04-rubicon-findings/issues/644)			
## [[H-631]  Denial of service against BuyAllAmount in RubiConMarket under certain conditions](https://github.com/code-423n4/2023-04-rubicon-findings/issues/631)			
## [[H-600]  Incorrect and duplicate fee deduction could cause users to lose part of profit due to a smaller long/short exposure](https://github.com/code-423n4/2023-04-rubicon-findings/issues/600)			
## [[H-587]  Reentrancy possible in 6 functions of RubiconMarket core contract](https://github.com/code-423n4/2023-04-rubicon-findings/issues/587)			
## [[H-583]  Position could be removed if there is collateral / debt in the position](https://github.com/code-423n4/2023-04-rubicon-findings/issues/583)			
## [[H-567]  If bathToken token has already entered the market, then owner cannot open a long/short position with this bathToken](https://github.com/code-423n4/2023-04-rubicon-findings/issues/567)			
## [[H-558]  Prevent owner from exiting the market](https://github.com/code-423n4/2023-04-rubicon-findings/issues/558)			
## [[H-551]  Division rounding errors for maker and taker fees become large enough to incentivise abuse by splitting orders for fee evasion when token is USDC](https://github.com/code-423n4/2023-04-rubicon-findings/issues/551)			
## [[H-546]  Dos attack to open position](https://github.com/code-423n4/2023-04-rubicon-findings/issues/546)			
## [[H-545]  When opening a position, the collateral of the previous position is used for borrowing, which makes the user more easily liquidated](https://github.com/code-423n4/2023-04-rubicon-findings/issues/545)			
## [[H-499]  Users can bypass paying fees to the order maker](https://github.com/code-423n4/2023-04-rubicon-findings/issues/499)			
## [[H-497]  Users might get less assets than expected upon migration due to price manipulation attacks](https://github.com/code-423n4/2023-04-rubicon-findings/issues/497)			
## [[H-488]  `V2migrator.migrate()` can easily stop functioning for specific `bathTokenV1`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/488)			
## [[H-476]  Functions `setRewardsDuration` always revert and `lastTimeRewardApplicable` always return `block.timestamp`  when `periodFinish` is set](https://github.com/code-423n4/2023-04-rubicon-findings/issues/476)			
## [[H-473]  Griefer can cancel() other users active offers](https://github.com/code-423n4/2023-04-rubicon-findings/issues/473)			
## [[H-441]  user loses funds if they call rubicall() with any ETH along with their tokens.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/441)			
## [[H-423]  The last borrowed asset will not be collateralized and the user may be liquidated due to insufficient collateral](https://github.com/code-423n4/2023-04-rubicon-findings/issues/423)			
## [[H-410]  User can steal all rewards and drain the pool](https://github.com/code-423n4/2023-04-rubicon-findings/issues/410)			
## [[H-377]  buy() fails to deduct fees from ``spend`` when sending ``buy_gem`` tokens to _offer.recipient, such over-sending will drain the contract (loss of funds).](https://github.com/code-423n4/2023-04-rubicon-findings/issues/377)			
## [[H-361]  User is unable to close position in Position.sol due to incorrect calculation of trading fee](https://github.com/code-423n4/2023-04-rubicon-findings/issues/361)			
## [[H-348]  Users lose funds to fees when the best order is the one submitted by the same user](https://github.com/code-423n4/2023-04-rubicon-findings/issues/348)			
## [[H-347]  Cancel() in RubiconMarket may fail resulting in a loss of funds if the user wishes to cancel](https://github.com/code-423n4/2023-04-rubicon-findings/issues/347)			
## [[H-301]  Rewards distribution continues after the reward duration expires.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/301)			
## [[H-296]  Attacker can profit from front-run closePosition to cause user losses](https://github.com/code-423n4/2023-04-rubicon-findings/issues/296)			
## [[H-282]  Incorrect fee handling in Position.sol's Market Buy/Sell functions](https://github.com/code-423n4/2023-04-rubicon-findings/issues/282)			
## [[H-281]  Due to the loss of precision, openPosition will make the user's leverage higher than expected](https://github.com/code-423n4/2023-04-rubicon-findings/issues/281)			
## [[H-259]  Creation of new orders can become impossible on active pairs because of gas issues](https://github.com/code-423n4/2023-04-rubicon-findings/issues/259)			
## [[H-239]  There is no user-controllable minimum receiving amount when `openPosition` and`closePosition` which may lead to price manipulation attacks](https://github.com/code-423n4/2023-04-rubicon-findings/issues/239)			
## [[H-201]  Borrower could repay lesser amount due to flawed logic in `Position._repay()`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/201)			
## [[H-56]  `can_offer` Modifier implementation does not revert](https://github.com/code-423n4/2023-04-rubicon-findings/issues/56)			


# Medium Severity Primary Submissions (106)

## [[M-1371] BPS denominator should be 10000](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1371)			
## [[M-1344] [M-04] Frontrunning in the take function can lead to an attacker stealing a users' position in the buy function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1344)			
## [[M-1336] `RubiconMarket._matcho` doesn't consider market fees](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1336)			
## [[M-1335] Fee calculation is wrong in `Position._marketBuy`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1335)			
## [[M-1333] `Position._marketSell` might revert due to lack of asset tokens](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1333)			
## [[M-1312] Fee inclusivity calculations are inaccurate in RubiconMarket](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1312)			
## [[M-1304] Fee calculation is wrong in `FeeWrapper`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1304)			
## [[M-1298] Low level calls to accounts with no code will succeed in `FeeWrapper`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1298)			
## [[M-1295] Rewards for initial period may be lost in `BathBuddy` contract](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1295)			
## [[M-1290] `notifyRewardAmount` can be used to dilute rewards](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1290)			
## [[M-1286] BathBuddy contract should implement methods to pause and unpause contract](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1286)			
## [[M-1257] No deadline parameter in `sellAllAmount()` and `buyAllAmount()` functions:](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1257)			
## [[M-1225] No cap on fees can result in loss of funds for clients](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1225)			
## [[M-1185] lowering interest rate will cause `closePosition` to fail](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1185)			
## [[M-1172] Anyone can create buddy for himself without calling `BathHouseV2.createBathToken` function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1172)			
## [[M-1167] Missing a check for minimum sell amount at make function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1167)			
## [[M-1158] Inconsistent reward payout before and after periodFinish[token]](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1158)			
## [[M-1149] Fee accounted twice in `Position._rubiconSwap()`, results in less asset received than what it should](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1149)			
## [[M-1145] Array Length Mismatch in `BathHouseV2.claimRewards` function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1145)			
## [[M-1144] If feeBPS is too low it might lead to revert in Buy function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1144)			
## [[M-1142] Precision Loss in `buy()` can result in maker getting unfair trade](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1142)			
## [[M-1107] Repeated Calls to "sellAllAmount" can cause a Denial-of-Service (DoS) Attack.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1107)			
## [[M-1106] `buyAllAmount` will always revert when `buy` amount is greater than the best offer quote](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1106)			
## [[M-1096] buyEnabled is always true](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1096)			
## [[M-1077] Missing upper limit on `_rewardsDuration` can lead to setting up of arbitrarily large values](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1077)			
## [[M-1062] RubiconMarket.feeTo set to zero-address can DoS buy function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1062)			
## [[M-1032] No slippage protection on fee changes in RubiconMarket](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1032)			
## [[M-1019] owner can set himself as recipient when RubiconMarket.Make() called](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1019)			
## [[M-1012] No unstop() function in the contract ExpiringMarket](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1012)			
## [[M-1003] Wrong calculation of repayment amount in Position contract](https://github.com/code-423n4/2023-04-rubicon-findings/issues/1003)			
## [[M-949] `RubiconMarket` does not support ERC20 tokens that do not return bool on transfer (USDT, BNB, etc.)](https://github.com/code-423n4/2023-04-rubicon-findings/issues/949)			
## [[M-942] Owner of a position can transfer ownership of position to anyone without an update to positionAddresses in PoolsUtility](https://github.com/code-423n4/2023-04-rubicon-findings/issues/942)			
## [[M-940] Single-step process for critical ownership transfer can be dangerous](https://github.com/code-423n4/2023-04-rubicon-findings/issues/940)			
## [[M-938] _maxBorrow() function would lead to division by zero error, which further breaks the borrow functionality if the _bathToken price is unavailable.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/938)			
## [[M-933] Users can be rug pulled](https://github.com/code-423n4/2023-04-rubicon-findings/issues/933)			
## [[M-921] COMP rewards cannot be claimed if getReward() function is paused](https://github.com/code-423n4/2023-04-rubicon-findings/issues/921)			
## [[M-918] Broken invariant in `notifyRewardAmount` allows adding rewards without sending funds](https://github.com/code-423n4/2023-04-rubicon-findings/issues/918)			
## [[M-910] The function pointer fn in RubiconMarket.sol#buy() will never reach super.buy because matchingEnabled cannot be false](https://github.com/code-423n4/2023-04-rubicon-findings/issues/910)			
## [[M-907] Incorrect reward duration extension in notifyRewardAmount function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/907)			
## [[M-906] Calling `ExpiringMarket.stop` and `ExpiringMarket.isClosed` functions cannot pause any functionlities of the market](https://github.com/code-423n4/2023-04-rubicon-findings/issues/906)			
## [[M-904] User can possess less value than before when `V2Migrator.migrate` function is called to give up bathTokenV1 tokens and hold bathTokenV2 tokens](https://github.com/code-423n4/2023-04-rubicon-findings/issues/904)			
## [[M-900] `Position._marketBuy` or `Position._marketSell` function can be DOS'ed if corresponding `_quote` or `_asset` token is USDT](https://github.com/code-423n4/2023-04-rubicon-findings/issues/900)			
## [[M-899] Calling `Position._marketSell` function compares `fill_amt` that includes fee to `min_fill_amount` that does not include fee](https://github.com/code-423n4/2023-04-rubicon-findings/issues/899)			
## [[M-886] Last In First Out execution in order book](https://github.com/code-423n4/2023-04-rubicon-findings/issues/886)			
## [[M-871] openPosition() May not work](https://github.com/code-423n4/2023-04-rubicon-findings/issues/871)			
## [[M-854] `BathBuddy` rewards DoS](https://github.com/code-423n4/2023-04-rubicon-findings/issues/854)			
## [[M-853] # Miscalculation of pay_amt so that _matcho function doesn't work as expected](https://github.com/code-423n4/2023-04-rubicon-findings/issues/853)			
## [[M-850] FeeWrapper user can pay fees using ETH rather than ERC20](https://github.com/code-423n4/2023-04-rubicon-findings/issues/850)			
## [[M-847] Division before multiplication can cause unnecessary rounding loss.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/847)			
## [[M-846] _buys() function in RubiconMarket.sol should use "<=" instead of "<" to determine if an offer is dust offer.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/846)			
## [[M-835] Chain reorganization could affect position opening and closing](https://github.com/code-423n4/2023-04-rubicon-findings/issues/835)			
## [[M-831] [M-3] Offer is deleted but unsorted from order book when outstanding amount is less than _dust](https://github.com/code-423n4/2023-04-rubicon-findings/issues/831)			
## [[M-819] Lack of validation for the `rewardsDuration`, which lead to no reward for the certain `rewardToken`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/819)			
## [[M-811] call() should be used instead of transfer()](https://github.com/code-423n4/2023-04-rubicon-findings/issues/811)			
## [[M-793] Wrong events data when migrating](https://github.com/code-423n4/2023-04-rubicon-findings/issues/793)			
## [[M-762] getPayAmountWithFee is calculated incorrectly, it should add the fee instead of subtracting it](https://github.com/code-423n4/2023-04-rubicon-findings/issues/762)			
## [[M-725] The function buys() contains an internal function that will always return false. Leading to unexpected results](https://github.com/code-423n4/2023-04-rubicon-findings/issues/725)			
## [[M-721] No feature to claim reward of across all pools](https://github.com/code-423n4/2023-04-rubicon-findings/issues/721)			
## [[M-708] Positions are heavily prone to MEV](https://github.com/code-423n4/2023-04-rubicon-findings/issues/708)			
## [[M-670] Position contract allows to interact with positions that are liquidated](https://github.com/code-423n4/2023-04-rubicon-findings/issues/670)			
## [[M-654] address variables are not checked which could lead to transfer of funds to a wrong address - FeeWrapper contract](https://github.com/code-423n4/2023-04-rubicon-findings/issues/654)			
## [[M-647] Proper constructor arguments validation needed in V2Migrator contract](https://github.com/code-423n4/2023-04-rubicon-findings/issues/647)			
## [[M-604] Position._borrowLimit doesn't use exisiting collateral in case if user doesn't have any `_bathToken`](https://github.com/code-423n4/2023-04-rubicon-findings/issues/604)			
## [[M-601] No greater than 100% check in RubiconMarket.setFeeBPS can result in underflow RubiconMarket.buy](https://github.com/code-423n4/2023-04-rubicon-findings/issues/601)			
## [[M-586] repay function can be DOSed](https://github.com/code-423n4/2023-04-rubicon-findings/issues/586)			
## [[M-576] Not using storage slots for all variable in the RubiconMarket can break the storage layout in an upgrade](https://github.com/code-423n4/2023-04-rubicon-findings/issues/576)			
## [[M-557] Potential infinite loop in `_borrowLimit` function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/557)			
## [[M-555] _leverageCheck incorrectly reverts some short leveraged positions](https://github.com/code-423n4/2023-04-rubicon-findings/issues/555)			
## [[M-553] User can front-run `batchRequote()`, `cancel()`, and `batchCancel()` to take advantage of more favourable offer terms before they are removed](https://github.com/code-423n4/2023-04-rubicon-findings/issues/553)			
## [[M-542] ``_borrowLimit()`` might over-borrow  when ``_assetAmount == _desiredAmount`` in the last loop iteration.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/542)			
## [[M-541] The Position._calculateDebt() does not calculate interest correctly](https://github.com/code-423n4/2023-04-rubicon-findings/issues/541)			
## [[M-536] Reward tokens could be stuck on BathBuddy contract and there is no function to transfer them out](https://github.com/code-423n4/2023-04-rubicon-findings/issues/536)			
## [[M-529] Leverage check will always fail due to wrong require statement provided](https://github.com/code-423n4/2023-04-rubicon-findings/issues/529)			
## [[M-521] Unsafe casting of user amount from uint256 to uint128](https://github.com/code-423n4/2023-04-rubicon-findings/issues/521)			
## [[M-517] Collateral factor could be 0 which should not be alowed](https://github.com/code-423n4/2023-04-rubicon-findings/issues/517)			
## [[M-510] Fee should not be zero in buy market or sell market activities](https://github.com/code-423n4/2023-04-rubicon-findings/issues/510)			
## [[M-495] Reentrancy on FeeWrapper could be used to break foreign implementations](https://github.com/code-423n4/2023-04-rubicon-findings/issues/495)			
## [[M-494] FeeWrapper arbitrary calls enable gas theft](https://github.com/code-423n4/2023-04-rubicon-findings/issues/494)			
## [[M-493] Users of other protocols can temporarily freeze non payable rubicalls for some tokens](https://github.com/code-423n4/2023-04-rubicon-findings/issues/493)			
## [[M-489] Zero reward rate calculation impedes low-decimals token distributions](https://github.com/code-423n4/2023-04-rubicon-findings/issues/489)			
## [[M-480] Transaction can be failed in the "_buys" function of "RubiconMarket" contract.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/480)			
## [[M-457] RubiconMarket: buy() may not take any fee for tokens with low decimal precision](https://github.com/code-423n4/2023-04-rubicon-findings/issues/457)			
## [[M-412] `RubiconMarket` buys can not be disabled if offer matching is disabled](https://github.com/code-423n4/2023-04-rubicon-findings/issues/412)			
## [[M-409] The used oracle has stablecoins like USDT and USDC fixed at 1 USD price](https://github.com/code-423n4/2023-04-rubicon-findings/issues/409)			
## [[M-396] The curve of short leverage position is not smooth and may cause users to open positions that are different from expectations](https://github.com/code-423n4/2023-04-rubicon-findings/issues/396)			
## [[M-360] Missed deals due to inadequate logic robustness in super.buy()](https://github.com/code-423n4/2023-04-rubicon-findings/issues/360)			
## [[M-359] [M-02] No rewards period will be set when setRewardsDuration is called](https://github.com/code-423n4/2023-04-rubicon-findings/issues/359)			
## [[M-355] [M-01] Initial user/s will not be set a rewards duration or rewards amount by the admin in setRewardsDuration() and notifyRewardAmount().](https://github.com/code-423n4/2023-04-rubicon-findings/issues/355)			
## [[M-349] Partial orders  will fail because buy() reverts when there is not enough liquidity in the market](https://github.com/code-423n4/2023-04-rubicon-findings/issues/349)			
## [[M-319] Divison Before multipcation incurs heavy precision loss when borrowing asset from Position](https://github.com/code-423n4/2023-04-rubicon-findings/issues/319)			
## [[M-315] Lack of consideration for Liquidation when shortfall happens.](https://github.com/code-423n4/2023-04-rubicon-findings/issues/315)			
## [[M-293] Both buyAllAmountWithLeverage and sellAllAmountWithLeverage always revert](https://github.com/code-423n4/2023-04-rubicon-findings/issues/293)			
## [[M-271] chainlink oracle integration should check if the L2 sequencer is active](https://github.com/code-423n4/2023-04-rubicon-findings/issues/271)			
## [[M-269] User should not perform migration multiple times](https://github.com/code-423n4/2023-04-rubicon-findings/issues/269)			
## [[M-258] Incorrect decimal handling in Position.sol truncate accured interest rate](https://github.com/code-423n4/2023-04-rubicon-findings/issues/258)			
## [[M-255] `FeeWrapper._chargeFeePayable` may revert as checks is too restrictive](https://github.com/code-423n4/2023-04-rubicon-findings/issues/255)			
## [[M-238] `Position#_repay` does not consider the balance in the contract when judging the obtained quote](https://github.com/code-423n4/2023-04-rubicon-findings/issues/238)			
## [[M-228] The attacker may maliciously increase the gas fee of the migrate](https://github.com/code-423n4/2023-04-rubicon-findings/issues/228)			
## [[M-213] `feeTo` set to zero-address can DoS the `rubicall` function](https://github.com/code-423n4/2023-04-rubicon-findings/issues/213)			
## [[M-212] Must approve by zero first](https://github.com/code-423n4/2023-04-rubicon-findings/issues/212)			
## [[M-181] Missing constructor for owner assignment in DSAuth](https://github.com/code-423n4/2023-04-rubicon-findings/issues/181)			
## [[M-170] No way to change bathToken configuration if it is added wrongly for an underlying token](https://github.com/code-423n4/2023-04-rubicon-findings/issues/170)			
## [[M-161] SimpleMarket.calcAmountAfterFee reverts if amount is zero](https://github.com/code-423n4/2023-04-rubicon-findings/issues/161)			
## [[M-154] Offer maker may not be able to cancel offer using account that made the offer](https://github.com/code-423n4/2023-04-rubicon-findings/issues/154)			
## [[M-151] RubiconRouter `maxSellAllAmount` tokens mismatch](https://github.com/code-423n4/2023-04-rubicon-findings/issues/151)			
## [[M-4] Dependency Confusion Attack Deu to Unclamed Package](https://github.com/code-423n4/2023-04-rubicon-findings/issues/4)			

