TRANSFERING KIBToken TO YOURSELF INCREASES YOUR BALANCE

Lines of code Vulnerability details Impact using temporary variables to update balances is a dangerous construction. If transferred to yourself, it will cause your balance to increase, thus growing the token balance infinitely Proof of Concept KIBToken overrides transfer to perform the transfer o...

LinearDistributor.declareReward: previouslyVested may update incorrectly, which will cause some rewards to be lost

Lines of code Vulnerability details Impact In LinearDistributor.declareReward , distributed represents the reward to distribute and is calculated using netVestcurrentlyVested - previouslyVested. At the same time, distributed cannot exceed balance, which means that if balance linearBondedValue...

Cybersecurity health and how to stay ahead of attackers with Linda Grasso

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Linda Grasso, the...

Cybersecurity health and how to stay ahead of attackers with Linda Grasso

The security community is continuously changing, growing, and learning from each other to better position the world against cyberthreats. In the latest post of our Community Voices blog series, Microsoft Security Senior Product Marketing Manager Brooke Lynn Weenig talks with Linda Grasso, the...

SUSE CVE-2018-13684

The mintToken function of a smart contract implementation for ZIP, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...

SUSE CVE-2018-14722

An issue was discovered in evaluateautomountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1. Code execution as root can occur via a specially crafted filesystem label if btrfs-scrub,balance,trim are set to auto in /etc/sysconfig/btrfsmaintenance this is not the default, thou...

BeefyAdapter._protocolWithdraw() can revert for some boosters

Lines of code Vulnerability details When withdrawing from an adapter, the function does an internal call to protocolWithdraw 210: function withdraw 211: address caller, 212: address receiver, 213: address owner, 214: uint256 assets, 215: uint256 shares 216: internal virtual override 217: if calle...

Changing reward speed calculates wrong rewardsEndTimestamp

Lines of code Vulnerability details Impact In MultiRewardStaking.changeRewardSpeed the new rewardsEndTimetamp is calculated based on the current balance of reward tokens in the contract. However, a fraction of this balance might already be accrued and accounted as reward, but just has not been...

MultiRewardEscrow.claimRewards() can break for rebasing tokens

Lines of code Vulnerability details Rebasing tokens make balanceOf modifications arbitrarily e.g: Aave share tokens. If such token is used in an escrow, the balance could become insufficient at the time of claiming rewards, making it impossible to claim rewards for that escrow. Impact Medium Proo...

Risk of reentrancy attacks in the claimRewards function

Lines of code Vulnerability details Impact The claimRewards function in the MultiRewardStaking contract is used by users to claim token rewards, but because the function does not contain a nonReentrant modifier and does not implement the CEI standard check-effect-interact it can be subject to...

## Mathematical Modelling Cause a Significant Roundoff Error

Lines of code Vulnerability details Mathematical Modelling Cause a Significant Roundoff Error Function drippedAmt calculates the ended cycles. when calculating ended cycles it takes two divisions which cause round off error. Let's consider this scenario. Deposited token - WBTC amtPerSec = 1000000...

User's claim can revert when attackers call withdrawFee several times

Lines of code Vulnerability details Impact withdrawFee can be called several times, so attackers can use this to drain Erc20Quest's balance. Proof of Concept When the admin calls withdrawRemainingTokens, protocolFee + unclaimedTokens left in the Erc20Quest contract. If unclaimedTokens =...

Integer Overflow Vulnerability in _addSplittable Function.

Lines of code Vulnerability details Impact splitsStorage.splitsStatesuserId.balancesassetId.splittable += amt; This vulnerability, if exploited, would allow an attacker to add a large amount of funds to a user's splittable balance, causing it to exceed the maximum value that the uint128 type can...

TimeswapV2LiquidityToken should not use totalSupply()+1 as tokenId

Lines of code Vulnerability details Impact Assuming ERC1155Enumerable is acting normally, there is a Accounting Issue about TimeswapV2LiquidityToken and TimeswapV2Token's tokenId. Different liquidities can have the same tokenId, leading to serious balance manipulation. I'm submitting this issue a...

early user can call issue() and then melt() to increase basketsNeeded to supply ratio to its maximum value and then melt() won't work and contract contract features like issue() won't work

Lines of code Vulnerability details Impact Function melt melt a quantity of RToken from the caller's account, increasing the basket rate. basket rate should be between 1e9 and 1e27 and function requireValidBUExchangeRate checks that if it's not in interval the the code would revert. the call to...

Future Epoch Pending Redemption Balance Set Vulnerability

Lines of code Vulnerability details Impact The setPendingRedemptionBalance function allows an admin to set the balance of a user's pending redemption for a specific epoch. However, it does not properly check that the epoch being set is in the past and not in the future. An attacker could...

Rapid7 Announces Global Days Off to Support Employees in 2023

On January 3rd, it was a little bit quieter than usual here at Rapid7. That's because our offices were closed for our first of five Global Days Off for 2023. Global Days Off are designed to encourage teams around the world to unplug and rest, enabling them to bring their best selves back to work...

The vulnerability of Huawei’s mobile phone software, related to authentication errors, allows attackers to bypass the digital balance limit.

The vulnerability of Huawei’s mobile phone software relates to authentication errors. Exploiting this vulnerability could allow a hacker to bypass the digital balance limit...

PaprController should not pay the swap fee in buyAndReduceDebt

Lines of code Vulnerability details Impact The best case scenario is that the paprController doesn't have any underlying tokens, in which case, buyAndReduceDebt won't work when there is a swapFee. Otherwise, paprController ends up paying for the swapFee. Even if there isn't a swap fee, the user c...

function buyAndReduceDebt() spend more underlying token than user specified and also code doesn't check that swapFeeBips is less than BIPS_ONE and user can lose some of his underlying token balance that he gave protocol spending approval

Lines of code Vulnerability details Impact user can specify fee recipient and fee amount to send to that recipient and it is calculated by amount swapFeeBips / BIPSONE but there is no check in the code to make sure swapFeeBips is less than BIPSONE and if user set wrong value by mistake or client...