User funds can be lost

Lines of code Vulnerability details Impact User funds sent by users can be lost forever Proof of Concept The contract LendingLedger.sol implements the function receive external payable to allow to the protocol to deposit the Canto used in the expected behaviour. But since the receive external...

Malicious code in web3tool-eth-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d12be8620708021936234e789248dd4ad0826cef81ef02171285815f476fb742 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in web3tool-eth-contract

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-1063 Malicious code in web3tool-eth-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d12be8620708021936234e789248dd4ad0826cef81ef02171285815f476fb742 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-39363

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

PYSEC-2023-142

Vyer is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

Xxe

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363

Vyper CVE-2023-39363 vulnerability: in Vyper versions 0.2.15, 0.2.16, and 0.3.0, named re-entrancy locks are allocated per function, not per key, enabling cross-function re-entrancy when a contract uses @nonreentrant with a specific key and path-dependent state updates before storage (breaking ch...

CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

GeVault cannot deposit ETH

Lines of code Vulnerability details Impact The GeVault contract has two instances where the require statement for token validation can cause reverts. In the first instance, the contract allows only token0 and token1 addresses for withdrawal, making it impossible to withdraw ETH. In the second...

CONTROLLED LOW-LEVEL CALL

Lines of code Vulnerability details Impact The contract was using call which was accepting address controlled by a user. This can have devastating effects on the contract as a delegate call allows the contract to execute code belonging to other contracts but using it’s own storage. This can very...

Some functions in TokenisableRange contracts does not allow user to deadline.

Lines of code Vulnerability details Impact Not allowing users to supply their own deadline could potentially expose them to sandwich attacks Proof of Concept Consider the following scenario: if fee0 100 bal0 && fee1 100 bal1 TOKEN0.token.safeIncreaseAllowanceaddressPOSMGR, fee0;...

The system is subjected to Cross-Contract Reentrancy due to Insufficient validation for tokens, source and liquidity Pairs

Lines of code Vulnerability details Impact A malicious actor can gain control of the liquidation process which can manipulate the POOL token price Proof of Concept Almost all the pieces of the protocol are open to everyone with no guard, and that can cause a serious problem. consider the followin...

RETURN VALUE OF LOW LEVEL call FUNCTION IS NOT CHECKED FOR SUCCESFUL VALUE TRANSFER

Lines of code Vulnerability details Impact The V3Proxy.swapTokensForExactETH and V3Proxy.swapExactTokensForETH functions use the low level call function to transfer Eth to the msg.sender as shown below: payablemsg.sender.callvalue: amountOut""; But there is no verification of the return value of...

Inflation attacks with virtual shares and assets on GeVault

Lines of code Vulnerability details Impact An inflation attacks can be done on the first deposit into the GeVault contract. Making the first real depositor losing his deposit. Proof of Concept Inflation attack steps : First, Alice the attacker need to craft a deposit that put valueX8 = 1 = Thus...

Unauthorized Access to Critical Functions in Smart Contract

Lines of code Vulnerability details Description The provided smart contract contains critical functions, such as close, closeDebt, and withdrawOptionAssets, that can be called by any external address without proper authentication or authorization checks. This lack of access control exposes the...

The treasury address can be updated by the contract owner to point to a malicious address after deployment

Lines of code Vulnerability details Impact Any fees or funds sent to the treasury could potentially be stolen or manipulated Proof of Concept The treasury address can be updated by the contract owner to point to a malicious address after deployment. This presents a risk as the treasury receives a...