Contracts are susceptible for Head Overflow Bug in Calldata

Lines of code Vulnerability details Impact ABI-encoding a tuple with a statically-sized calldata array in the last component would corrupt 32 leading bytes of its first dynamically encoded component. Proof of Concept The functions are taking input arguments as calldata. Following contracts are...

Users pay excessive gas cost for sending bytecode hashes to L1

Lines of code Vulnerability details Impact When deploying new contracts, users are forced to pay more gas than is required to publish the bytecode hash to the L1. Proof of Concept When users deploy new smart contracts, the protocol marks the hashes of the bytecodes of the contracts as known and...

getBlockHashEVM() function vulnerability leads to DoS attack

Lines of code Vulnerability details Impact By using the getBlockHashEVM function with erroneous input, an attacker can take advantage of this vulnerability to deprive the contract of gas and launch a denial of service DoS attack against the network, contracts and valid transactions will therefore...

Incorrect Calculation

OpenZeppelin Contracts is vulnerable to Incorrect Calculations. The vulnerability exists in the beforeTokenTransfer function because ERC721Consecutive does not update balances when the batch has a size of one and consists of a single token, resulting in a token overflow when calling the balanceOf...

CounterV2.setNewVariable can be invoked by anyone.

Lines of code Vulnerability details Impact The CounterV2.setNewVariable is an open function which can be invoked by anyone. function setNewVariableuint256 newVariable external reinitializer2 newVariable = newVariable; This function is intended to be invoked by PluginSetupProcessor &...

In the beginning its relatively easy to gain majority share

Lines of code Vulnerability details Impact As mentioned in the document, Although possible, the permissions to execute arbitrary actions or upgrade the DAO should not be given to EOAs as this poses a security risk to the organization if the account is compromised or acts adversarial. Instead, the...

ActivePool.sol – Re-entrancy risk on _rebalance function

Lines of code Vulnerability details The rebalance function is vulnerable to a reentrancy attack. Specifically, an external callee can take over the control flow of the function by calling back into the ActivePool contract via a method that triggers the rebalance function again before it completes...

Malicious code in opium-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32280411ef552cdf3eb62fb622c11207ddde4e1ae3a16f05858b42e124200819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-656 Malicious code in opium-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32280411ef552cdf3eb62fb622c11207ddde4e1ae3a16f05858b42e124200819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-26488

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

Buffer overflow

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

CVE-2023-26488 OpenZeppelin Contracts contains Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

CVE-2023-26488 OpenZeppelin Contracts contains Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

CVE-2023-26488 OpenZeppelin Contracts contains Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

CVE-2023-26488

OpenZeppelin Contracts ERC721Consecutive has a balance-update bug for batches of size 1, causing balanceOf to overflow. Root cause: balances not updated after mint/batch transfers. Impact is partial (balance overflow risk) and fixes were applied in version 4.8.2; update to 4.8.2 or later to remed...

OpenZeppelin Contracts contains Incorrect Calculation

Impact The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by balanceOf. The issue exclusively presents with...

@aragon/core-contracts (>=0.7.0-alpha, <=0.8.0-alpha), @aragon/osx (>=1.2.0, <=1.3.0) +42 more potentially affected by CVE-2023-26488 via @openzeppelin/contracts-upgradeable (>=4.8.0, <=4.8.1)

@openzeppelin/contracts-upgradeable NPM version =4.8.0, =0.7.0-alpha, =1.2.0, =0.0.1, =0.0.1, =0.0.1, =1.0.4, =2.0.0, =1.0.1, =1.0.15, =1.0.27, =1.0.16, =1.0.29 and more Source cves: CVE-2023-26488 Source advisory: OSV:GHSA-878M-3G6Q-594Q...

@1inch/delegating (>=0.0.8, <=0.0.21), @1inch/erc20-pods (>=0.0.8, <=0.0.17) +67 more potentially affected by CVE-2023-26488 via @openzeppelin/contracts (>=4.8.0, <=4.8.1)

@openzeppelin/contracts NPM version =4.8.0, =0.0.8, =0.0.8, =1.1.2, =0.0.1, =2.0.0, =0.7.0-alpha, =1.2.0, =0.0.1, =1.0.4, =1.0.1, =1.0.15, =2.0.2 and more Source cves: CVE-2023-26488 Source advisory: OSV:GHSA-878M-3G6Q-594Q...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts that stems from an amount overflowing during transmission...

PT-2023-20679 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.8.2 Description: The ERC721Consecutive contract, designed for minting NFTs in batches, does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the...