Governance NFT holder, whose NFT was minted before Trading._handleOpenFees function is called, can lose deserved rewards after Trading._handleOpenFees function is called

Lines of code Vulnerability details Impact Calling the following Trading.handleOpenFees function does not approve the GovNFT contract for spending any of the Trading contract's tigAsset balance, which is unlike calling the Trading.handleCloseFees function below that executes...

Use of resignOwnership can lead to stuck NFT in contract

Lines of code Vulnerability details Impact Contract OwnableUpgradeable has a resignOwnership function that, if called, can potentially cause the loss of the NFT after a draw has been started. Proof of Concept These are the steps/conditions that make this issue happen: When the owner calls...

DoS after creating 100 raffles under one subscriptionID

Lines of code Vulnerability details Impact If a user adds new consumer, function VRFCoordinatorV2::addConsumer is called: function addConsumeruint64 subId, address consumer external override onlySubOwnersubId nonReentrant // Already maxed, cannot add any more consumers. if...

safeTransfer should be used instead of transferFrom in winnerClaimNFT

Lines of code Vulnerability details Impact The winner of the raffle may be a smart contract which doesn't handle NFTs, thus leaving the NFT irretrievably lost instead of being awarded to an address which can handle NFTs. Additionally, the NFT should be in the VRFNFTRandomDraw contract at the time...

CVE-2022-41273

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim with a manipulated link that appears to be a legitimate SAP...

CVE-2022-41273

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim with a manipulated link that appears to be a legitimate SAP...

Input validation

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim with a manipulated link that appears to be a legitimate SAP...

PT-2022-25782 · Sap · Sap Sourcing +1

Name of the Vulnerable Software and Affected Versions: SAP Sourcing and SAP Contract Lifecycle Management version 1100 Description: The issue arises from improper input sanitization, allowing an attacker to redirect a user to a malicious website. The attack is performed by sending an email with a...

CVE-2022-41273: URL Redirection to Untrusted Site

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website. In order to perform this attack, the attacker sends an email to the victim with a manipulated link that appears to be a legitimate SAP...

SAP Sourcing and SAP Contract Lifecycle Management 1100: Input validation error vulnerability

SAP Sourcing and SAP Contract Lifecycle Management are both products of SAP, an in-house application that provides an end-to-end solution for the procurement process. SAP Sourcing is an on-premise application that provides an end-to-end solution for the procurement process.SAP Contract Lifecycle...

Unlimited Global & User Withdrawal right after previous period ends and new period begins

Lines of code Vulnerability details Impact Checks for Global and User Withdraw Limit Per Period are missing for the first withdrawal request right AFTER period length expires and a new period begins. First withdrawal request amount after period length expires can be way higher than...

Wrong variable is used for the first parameter of depositHook.hook()

Lines of code Vulnerability details Impact Recipient is treated wrongly as sender. Proof of Concept As written here See DepositHook.solL43-L52, the first accepted parameter should be the sender. However, recipient See Collateral.solL53 is passed in here. Tools Used Manual Recommended Mitigation...

PrePOMarket.sol : a sender who is not included in the account list can front run and mint prior to setting the _mintHook

Lines of code Vulnerability details Impact a sender who is not included in the account list can front run and mint prior to setting the mintHook. Proof of Concept The contract says, Minting will only be done by the team, and thus relies on the mintHook to enforce access controls. This is also why...

Insufficient support for fee-on-transfer type of ERC20

Lines of code Vulnerability details Some ERC20 token implementations have a fee that is charged on each token transfer. This means that the transferred amount isn't exactly what the receiver will get. A call to IERC20token.transferrecipient, 100 with a fee-on-transfer FOT of 5% will entitle the...

Liquidity cannot be removed by an approved address via Router

Lines of code Vulnerability details Impact Using the Router, liquidity can only be removed by the owner of an NFT, which significantly limits liquidity management. The Pool contract, however, does allow approved addresses to remove liquidity. Proof of Concept The Router contract is a higher level...

Users can get free collateral when using non-reverting on failure baseTokens

Lines of code Vulnerability details Impact A user calling Collateral's deposit function when baseToken is a non-reverting on failure ERC20 token, can get an arbitrary amount of collateral without actually depositing a single base token in the contract. function depositaddress recipient, uint256...

exactInput allows stealing of funds via a malicious pool contract

Lines of code Vulnerability details Impact Users can lose funds during swapping. Proof of Concept The Router contract is a higher level contract that will be used by the majority of the users. The contract implements the exactInput functions that users call to perform multiple swaps in a single...

Lack of access control in AllowedMsgSenders contract.

Lines of code Vulnerability details Impact setAllowedMsgSenders lacks access control. This enables anyone to set themselves as an allowed message sender and call the send in tokenSender.sol to transfer out any amount bypassing all the checks imposed in the hooks. Proof of Concept...

Storage collision in Collateral.sol

Lines of code Vulnerability details Vulnerability details collateral.sol is an upgradeable contract. Upgradeable contracts should not use the constructor to initialize variables, as these will be set in the contract storage of the implementation contract, instead of the intended contract storage ...

user's funds lock and incorrect code behavior because users withdrawal amount won't get reset for all users in each userPeriodLength in WithdrawHook contract

Lines of code Vulnerability details Impact according to the comments in code: "Every time userPeriodLength seconds passes, the amount withdrawn for all users will be reset to 0" . but in current implementation only one of the users userToAmountWithdrawnThisPeriod value gets reset and this will...