1136 matches found
Google Takes Down Glupteba Botnet; Files Lawsuit Against Operators
Google’s Threat Analysis Group TAG has disrupted the blockchain-enabled botnet known as Glupteba, which is made up of around 1 million compromised Windows and internet of things IoT devices. In tandem, Google also filed a lawsuit against the botnet’s operators. Glupteba, already a formidable...
Smart Contract Bug Results in $31 Million Loss
A hacker stole $31 million from the blockchain company MonoX Finance , by exploiting a bug in software the service uses to draft smart contracts. Specifically, the hack used the same token as both the tokenIn and tokenOut, which are methods for exchanging the value of one token for another. MonoX...
RewardReinvestor Is Vulnerable To Sandwich Attacks
Handle leastwood Vulnerability details Impact The splitReinvest function in RewardReinvestor is called upon by bonded users. An attacker can monitor the blockchain for calls to this function and launch a sandwich attack in combination with a flash loan to steal funds. A malicious user is...
“Crypto” Means “Cryptography,” Not “Cryptocurrency”
I have long been annoyed that the word "crypto" has been co-opted by the blockchain people, and no longer refers to "cryptography." Im not the only one...
Cosmos: Unclaimed official s3 bucket of tendermint(tendermint-packages) which is used by many other blockchain companies in their code
An unclaimed official S3 bucket of Tendermint, which was also used by many other blockchain companies and developers, was discovered. An attacker could have hosted malicious files on the bucket, causing harm to the companies or developers using it for package installation. The vulnerability has...
CVE-2021-41135
The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includ...
CVE-2021-41135
The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includ...
Authorization
The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includ...
CVE-2021-41135 Authz Module Non-Determinism
The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus halt due to non-deterministic behaviour in a ValidateBasic method in the x/authz module. The MsgGrant of the x/authz module contains a Grant field which includ...
CVE-2021-41135
Summary: CVE-2021-41135 affects the Cosmos-SDK’s x/authz module where Grant.ValidateBasic() non-deterministically compares the grant expiration time to the node clock, enabling a chain with the authz feature enabled to halt via crafted transactions. This is reported for affected SDK versions, wit...
Proof-of-Stake (PoS) Ethereum consensus 安全漏洞
Proof-Of-Stake is a consensus mechanism used by the Ethereum Foundation's blockchain network to achieve distributed consensus. Proof-of-Stake PoS Ethereum consensus has a security vulnerability, the exploitation of which can lead to denial-of-service attacks...
Specification non-compliance in JUMPI
Impact In evm crate 0.31.0, JUMPI opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. Patches This is a high severity security advisory if you use evm crate for...
GHSA-PVH2-PJ76-4M96 Specification non-compliance in JUMPI
Impact In evm crate 0.31.0, JUMPI opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. Patches This is a high severity security advisory if you use evm crate for...
CVE-2021-41153
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In evm crate 0.31.0, JUMPI opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. This is a...
CVE-2021-41153 Specification non-compliance in JUMPI
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In evm crate 0.31.0, JUMPI opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. This is a...
CVE-2021-41153
The evm crate (Rust Ethereum VM)
museblockchain.com Improper Access Control vulnerability OBB-2176940
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Critical Flaw in OpenSea Could Have Let Hackers Steal Cryptocurrency From Wallets
A now-patched critical vulnerability in OpenSea, the world's largest non-fungible token NFT marketplace, could've been abused by malicious actors to drain cryptocurrency funds from a victim by sending a specially-crafted token, opening a new attack vector for exploitation. The findings come from...
OpenSea ‘Free Gift’ NFTs Drain Cryptowallet Balances
Users of OpenSea, the world’s largest digital-collectible marketplace, have found their cryptocurrency wallets ripped off thanks to cyberattackers weaponizing security bugs that allowed them to highjack user accounts. The attacks revolved around boobytrapped art files, which circulated in the for...