Privacy Pools Core

Sending ETH or tokens to the zero address in Entrypoint

No option to withdraw privately in an edge case in PrivacyPool

Potential deanonymization in PrivacyPool

Missing relay data checks in Entrypoint

Missing new pool checks in Entrypoint

Token decimals not considered in fee calculation in Entrypoint

Shared ASP tree across all pools in Entrypoint

Missing validation for postman and owner in Entrypoint

Missing minimum amount for withdrawals in PrivacyPool

Missing check that processooor is not equal to depositor in PrivacyPool

Only the latest ASP root is used for ASP inclusion proof verification in PrivacyPool

Deposit fee can be unexpected in Entrypoint

Missing check that recipient is not the zero address in Entrypoint

Unable to call relay after pool removal in Entrypoint

Expression is evaluated twice in Entrypoint

Confusing constant value definitions in Entrypoint

Redundant function parameter in Entrypoint

Hardcoded number in Entrypoint