OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts version 4.7.0 through versions prior to 4.9.2. No information about this vulnerability is available at this time, so please stay tuned to CNNVD or vendo...

CVE-2023-34449

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through CallBuilder::delegate or...

CVE-2023-34449

The CVE-2023-34449 issue affects ink! (Rust-based eDSL for Substrate). Affected versions are 4.0.0 up to, but not including, 4.2.1; the bug arises from incorrect decoding of the return value when using delegate call mechanics via CallBuilder::delegate or ink_env::invoke_contract_delegate. The roo...

expirationPeriod in the strategy contracts is not checked when calling LlamaCore.execute

Lines of code Vulnerability details Impact If executionPeriod is set to an extremely short time or even 0, then all actions can never be executed. Proof of Concept There are 7 states in an Action flow: Active, Canceled, Failed, Approved, Queued, Expired, Executed. Generally, the sequence goes lik...

CVE-2023-34449: Improper Check for Unusual or Exceptional Conditions

ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through CallBuilder::delegate or...

Arbitrary delegatecalls from LlamaAccount can be used to steal assets

Lines of code Vulnerability details Impact Using delegatecall to call arbitrary contracts is highly dangerous as it can be used to steal assets. An attacker could sneak in a contract that steals all the assets owned by the LlamaAccount contract. Proof of Concept Below is a diff to the existing...

Lack of Event Signature Verification

Lines of code Vulnerability details Impact The functions submitExchangeRateData, submitSDPrice, and submitValidatorStats emit events without verifying the signature of the calling contract. Malicious contracts can exploit this by emitting events with misleading information, potentially deceiving...

pause/unpause functionnalities not implemented in many pausable contracts

Lines of code Vulnerability details Impact The following contracts : SocializingPool, StaderOracle, OperatorRewardsCollector and Auction are supposed to be pausable as they all inherit from PausableUpgradeable but they don't implement the external pause/unpause functionalities which means it will...

Problem with Day values

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. In solidity, block.timestamp makes use of seconds in calculating time but in the highlighted codes, the stated period and their comments was miscalculated. 7200 was referred to as 24 hours and was used...

4337-snap (>=0.1.0, <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5) +1410 more potentially affected by CVE-2023-34234 via @openzeppelin/contracts (>=4.3.0, <=4.9.0)

@openzeppelin/contracts NPM version =4.3.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2023-34234 Source advisory: OSV:GHSA-5H3X-9WVQ-W4M2...

4337-snap (>=0.1.0, <=0.1.1), @0xflair/contracts-registry (>=0.107.10, <=0.123.2) +375 more potentially affected by CVE-2023-34234 via @openzeppelin/contracts-upgradeable (>=4.3.0, <=4.8.3)

@openzeppelin/contracts-upgradeable NPM version =4.3.0, =0.1.0, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.107.0, =4.0.0-prerelease-17, =2.0.0-prerelease-4, =0.2.1-alpha, =0.2.1-beta2 and more Source cves: CVE-2023-34234 Source advisory:...

CVE-2023-34234

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the...

CVE-2023-34234 Governor proposal creation may be blocked by frontrunning in OpenZeppelin

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the...

CVE-2023-34234 Governor proposal creation may be blocked by frontrunning in OpenZeppelin

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the...

CVE-2023-34234

OpenZeppelin Contracts’ Governor-related vulnerability (CVE-2023-34234) allows an attacker to frontrun the creation of a proposal, enabling the attacker to become the proposer and repeatedly cancel proposals. Affected: Governor (v4.9.0) and GovernorCompatibilityBravo (since v4.3.0). Root cause: l...

CVE-2023-34234

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the...

CVE-2023-34234: Missing Authorization

OpenZeppelin Contracts is a library for smart contract development. By frontrunning the creation of a proposal, an attacker can become the proposer and gain the ability to cancel it. The attacker can do this repeatedly to try to prevent a proposal from being proposed at all. This impacts the...

PT-2023-24758

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions 4.3.0 through 4.9.0 Description The issue allows an attacker to become the proposer and gain the ability to cancel a proposal by frontrunning its creation. This can be done repeatedly to prevent a proposal from...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts versions prior to 4.3.0 through 4.9.1 that stems from allowing an attacker to gain the ability to cancel a proposal by creating it in advance...

5 Ways Smart Contracts Are Making A Real-World Difference

By Waqas One of the most promising innovations in the blockchain industry is the smart contract. They provide a superior… This is a post from HackRead.com Read the original post: 5 Ways Smart Contracts Are Making A Real-World Difference...