**Contest repo:** https://github.com/code-423n4/2023-07-moonwell
**Findings repo:** https://github.com/code-423n4/2023-07-moonwell-findings/
**Judging by:** [Alcueca] (Discord: `alcueca`)
**Pre-sorting by:** [sorryNotsorry](https://twitter.com/0xSorryNotSorry) (Discord: `0xsorrynotsorry`)

# High Severity Primary Submissions (10)

## [[H-370] Any user can claim rewards infinitely from the market without respecting the accrued rewards time](https://github.com/code-423n4/2023-07-moonwell-findings/issues/370)
## [[H-347] MALICIOUS USER CAN PREVENT A BORROWER FROM ADDING LIQUIDITY TO THIER POSITION TO AVOID LIQUIDATION](https://github.com/code-423n4/2023-07-moonwell-findings/issues/347)
## [[H-267] Users positions can be directly liquidated when the admin changes the `collateralFactorMantissa` from a higher value to a lower value](https://github.com/code-423n4/2023-07-moonwell-findings/issues/267)
## [[H-227] liquidateBorrow() mTokens that do not enter the market can still be liquidated as collateral](https://github.com/code-423n4/2023-07-moonwell-findings/issues/227)
## [[H-118] Incorrect address is set as Wormhole Bridge, which breaks deploy](https://github.com/code-423n4/2023-07-moonwell-findings/issues/118)
## [[H-90] Incorrect getDerivedPriceThreeOracles() function per documentation](https://github.com/code-423n4/2023-07-moonwell-findings/issues/90)
## [[H-68] In Comptroller.sol, Some setter functions access control does not meet design per documentation](https://github.com/code-423n4/2023-07-moonwell-findings/issues/68)
## [[H-51] Malicious users can inflate their shares by minting, borrowing, and using borrowed funds to mint in a loop w/o increasing the underlying token balance of the mToken contract](https://github.com/code-423n4/2023-07-moonwell-findings/issues/51)
## [[H-21] supply/borrowIndex in rewardDistributor is not updated when mToken balance of a user is changed; user can easily front-run a reward accrual by depositing a lot of token to get more than his share of reward](https://github.com/code-423n4/2023-07-moonwell-findings/issues/21)
## [[H-4] Borrowing donated tokens to grief and then steal all the tokens in the protocol](https://github.com/code-423n4/2023-07-moonwell-findings/issues/4)

# Medium Severity Primary Submissions (47)

## [[M-406] External visibility modifier on function that should be callable from address(this). Doesnt seem right.](https://github.com/code-423n4/2023-07-moonwell-findings/issues/406)
## [[M-404] getUnderlyingPrice() should return 0 when errored](https://github.com/code-423n4/2023-07-moonwell-findings/issues/404)
## [[M-377] The vulnerability in the `scalePrice` function is due to the lack of precision protection during division, potentially resulting in rounding errors and inaccurate scaled prices.](https://github.com/code-423n4/2023-07-moonwell-findings/issues/377)
## [[M-368] THERE IS NO FUNCTIONALITY TO LIQUIDATE THE `DEPRECATED` MTOKEN MARKETS](https://github.com/code-423n4/2023-07-moonwell-findings/issues/368)
## [[M-344] ## [M-07] ERC20 return values not checked](https://github.com/code-423n4/2023-07-moonwell-findings/issues/344)
## [[M-338] Inaccurate implementation of ECDSA creates signature malleability](https://github.com/code-423n4/2023-07-moonwell-findings/issues/338)
## [[M-326] No limit on the number of emission configs per MToken in `MultiRewardDistributor`](https://github.com/code-423n4/2023-07-moonwell-findings/issues/326)
## [[M-325] `excuteProposal` can fail due to Wormhole guardian change](https://github.com/code-423n4/2023-07-moonwell-findings/issues/325)
## [[M-321] `emissionToken` cannot be reused](https://github.com/code-423n4/2023-07-moonwell-findings/issues/321)
## [[M-320] malicious `emissionToken` could poison rewards for a market](https://github.com/code-423n4/2023-07-moonwell-findings/issues/320)
## [[M-318] `emissionConfigOwner` owner can DoS emission end time](https://github.com/code-423n4/2023-07-moonwell-findings/issues/318)
## [[M-315] only `guardian` can change `guardian`](https://github.com/code-423n4/2023-07-moonwell-findings/issues/315)
## [[M-312] same `emissionToken` on different markets can steal each others emissions](https://github.com/code-423n4/2023-07-moonwell-findings/issues/312)
## [[M-308] `fastTrackProposalExecution` doesn't check `intendedRecipient`](https://github.com/code-423n4/2023-07-moonwell-findings/issues/308)
## [[M-304] ChainlinkOracle assumes that the assets of all USD denominated pair has 18 decimal places](https://github.com/code-423n4/2023-07-moonwell-findings/issues/304)
## [[M-290] Improper use of the approve function can lead to front running attacks.](https://github.com/code-423n4/2023-07-moonwell-findings/issues/290)
## [[M-270] `getPrice` will revert for tokens with more than 18 decimals](https://github.com/code-423n4/2023-07-moonwell-findings/issues/270)
## [[M-268] Proposals which intend to send native tokens to target addresses can't be executed](https://github.com/code-423n4/2023-07-moonwell-findings/issues/268)
## [[M-248] If all total supply of MToken available for flash loan, user can get profit by redeem and mint again.](https://github.com/code-423n4/2023-07-moonwell-findings/issues/248)
## [[M-245] `TemporalGovernor.fastTrackProposalExecution` should add `whenPaused`](https://github.com/code-423n4/2023-07-moonwell-findings/issues/245)
## [[M-239] User can prevent liquidation by enter another market that have low supply and borrow activity](https://github.com/code-423n4/2023-07-moonwell-findings/issues/239)
## [[M-232] Granting guardians the right to pause can break the contract](https://github.com/code-423n4/2023-07-moonwell-findings/issues/232)
## [[M-228] sendReward incorrectly handling claims when rewards accrued bigger than the current token holding, punishing big rewards holders](https://github.com/code-423n4/2023-07-moonwell-findings/issues/228)
## [[M-220] There is no way to absorb the excess cash into reserves](https://github.com/code-423n4/2023-07-moonwell-findings/issues/220)
## [[M-218] `MultiRewardDistributor.disburseSupplierRewardsInternal()` does not follow CEI pattern](https://github.com/code-423n4/2023-07-moonwell-findings/issues/218)
## [[M-217] `supplyCapGuardian` and `borrowCapGuardian` can abuse caps to prevent users from entering markets](https://github.com/code-423n4/2023-07-moonwell-findings/issues/217)
## [[M-204] Wrong calculation of cash available for borrow and redeem](https://github.com/code-423n4/2023-07-moonwell-findings/issues/204)
## [[M-187] _setCloseFactor is missing importan checks in comptroller contract](https://github.com/code-423n4/2023-07-moonwell-findings/issues/187)
## [[M-185] Missing approve 0 when calling approve function may revert with certain types of tokens](https://github.com/code-423n4/2023-07-moonwell-findings/issues/185)
## [[M-174] the `_addEmissionConfig` function did not allow to set the default emission value for both borrower and supplier](https://github.com/code-423n4/2023-07-moonwell-findings/issues/174)
## [[M-170] mintAllowed Fuction in Comptroller could fail](https://github.com/code-423n4/2023-07-moonwell-findings/issues/170)
## [[M-143] Initial deploy won't succeed because of too high `initialMintAmount` for USDC market](https://github.com/code-423n4/2023-07-moonwell-findings/issues/143)
## [[M-137] MErc20.mint() & redeem() are functionally swaps which expose users to unlimited slippage](https://github.com/code-423n4/2023-07-moonwell-findings/issues/137)
## [[M-135] Possible Incorrect utilizationRate](https://github.com/code-423n4/2023-07-moonwell-findings/issues/135)
## [[M-134] Borrower can cause a DoS by frontrunning a liquidation and repaying as low as 1 wei of the current debt](https://github.com/code-423n4/2023-07-moonwell-findings/issues/134)
## [[M-124] If the price of a market token goes to zero, the protocol could become insolvent](https://github.com/code-423n4/2023-07-moonwell-findings/issues/124)
## [[M-114] Incorrect chainId of Base in deploy script will force redeployment](https://github.com/code-423n4/2023-07-moonwell-findings/issues/114)
## [[M-108] Precision Loss in Coomptroller::liquidateCalculateSeizeTokens](https://github.com/code-423n4/2023-07-moonwell-findings/issues/108)
## [[M-95] When `Comptroller.sol#liquidateBorrowAllowed()` is called from `MErc20.sol#liquidateBorrow()`, the `actualRepayAmount` should be passed as parameter rather than `repayAmount`.](https://github.com/code-423n4/2023-07-moonwell-findings/issues/95)
## [[M-92] MToken May be Inflation Attack](https://github.com/code-423n4/2023-07-moonwell-findings/issues/92)
## [[M-67] Its not possible to liquidate deprecated market](https://github.com/code-423n4/2023-07-moonwell-findings/issues/67)
## [[M-62] Double-entrypoint underlying token allows market owner to withdraw underlying collateral without repaying debt](https://github.com/code-423n4/2023-07-moonwell-findings/issues/62)
## [[M-58] Borrower and Supplier rewards accrued could be lost when Admin replaces the reward distributor with a new reward distributor](https://github.com/code-423n4/2023-07-moonwell-findings/issues/58)
## [[M-27] Expediting a queued transaction may not work due to faulty implementation of the _queueProposal function in TemporalGovernor.sol](https://github.com/code-423n4/2023-07-moonwell-findings/issues/27)
## [[M-23] interestRateModel can cause update to historical accrual of MToken](https://github.com/code-423n4/2023-07-moonwell-findings/issues/23)
## [[M-19] a single emissionCap is not suitable for different tokens reward if they have different underlying decimals](https://github.com/code-423n4/2023-07-moonwell-findings/issues/19)
## [[M-18] borrowRateMaxMantissa should be specific to the chain protocol is being deployed to](https://github.com/code-423n4/2023-07-moonwell-findings/issues/18)