3000 matches found
_mint721() function can be broken because of strict equality check on token balance
Handle jayjonah8 Vulnerability details Impact In NFTXMarketplaceZap.sol the mint721 function has a require check that the balance must be equal to the amount of vault tokens in the contract. uint256 balance = count BASE - count INFTXVaultvault.mintFee; requirebalance ==...
Borrow should increase principal by withdrawn amount
Handle cmichel Vulnerability details The CreditLine.borrow function increases the principal by the amount parameter, but the borrower only receives tokenDiffBalance. // @audit increases by amount instead of tokenDiffBalance creditLineVariablesid.principal =...
Dust Token Balances Cannot Be Claimed By An admin Account
Handle leastwood Vulnerability details Impact Users who have a small claim on rewards for various promotions, may not feasibly be able to claim these rewards as gas costs could outweigh the sum they receive in return. Hence, it is likely that a dust balance accrues overtime for tokens allocated f...
Attacker can empty all the funds by creating fake promotions
Handle WatchPug Vulnerability details The current implementation of calculateRewardAmount allows a arbitrary epochId, which can even be a epochId numberOfEpochs. A malicious user can call claimRewards with epochIds larger than numberOfEpochs and claim other users' rewards. Furthermore, since...
Possibility to drain SavingsAccount contract assets
Handle kemmio Vulnerability details Impact A malicious actor can manipulate switchStrategy function in a way to withdraw tokens that are locked in SavingsAccount contract the risk severity should be reviewed Proof of Concept Firstly an attacker need to deploy a rogue strategy contract implementin...
ERC20Vault does not support fee-on-transfer token
Handle gzeon Vulnerability details Impact ERC20Vault does not support fee-on-transfer token since it does not check the balance received by the contract. Proof of Concept for uint256 i = 0; i 0 IERC20tokensi.safeTransferFromfrom, addressthis, tokenAmountsi; actualTokenAmounts = pushtokens,...
Locke.sol:Stream - arbitraryCall can be used to drain incentive tokens
Handle ScopeLift Vulnerability details Impact Governor can drain incentive balance via arbitraryCall Proof of Concept The Stream contract offers createIncentive and claimIncentive which is the way the contract "expects" incentives to go. Access to claiming incentives is limited to the stream...
Deposit token flash loan fees can be stolen by streamCreator
Handle 0x0x0x Vulnerability details Concept On recoverTokens function in Stream. Excess amount of deposit token is calculated as follows: uint256 excess = ERC20token.balanceOfaddressthis - depositTokenAmount - redeemedDepositTokens; This calculation does not include depositTokenFlashloanFeeAmount...
Extra fees paid for flash loans are unassigned
Handle 0x0x0x Vulnerability details Extra fees paid for flash loan are not included in total collected fees and they create excess balance which can be claimable by streamCreator. Extra fees should also get assigned to factory or atleast it should be clear that extra fees are for streamCreator...
Huawei Emui and Magic UI bypass vulnerability
Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. a bypass vulnerability exists in Huawei Emui and Magic UI. The vulnerability stems from an invalid digital balance setting in maintenance mode. An attacker could exploit the...
CVE-2021-37032
There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to work...
CVE-2021-37032
There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to work...
CVE-2021-37032
There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to work...
Security feature bypass
There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to work...
CVE-2021-37032
CVE-2021-37032 is described in connected CNVD/RH/NVD entries as a bypass vulnerability in Huawei Emui/Magic UI. The root cause is an invalid digital balance setting in maintenance mode, enabling a bypass that can cause Digital Balance to become inoperable on affected Huawei smartphones. Public de...
CVE-2021-37032
There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to work...
CVE-2021-37032: Undefined Security Weakness
There is a Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause Digital Balance to fail to work...
PT-2021-21462
Name of the Vulnerable Software and Affected Versions Huawei Smartphone affected versions not specified Description The issue is related to a Bypass vulnerability. Successful exploitation of this vulnerability may cause Digital Balance to fail to work. Recommendations At the moment, there is no...
Huawei Emui 安全漏洞
Huawei Emui is a mobile operating system developed on Android. magic Ui is a mobile operating system developed on Android. a bypass vulnerability exists in Huawei Emui and Magic UI. The vulnerability stems from an invalid digital balance setting in maintenance mode. An attacker could exploit the...
