Centralized mint

Lines of code Vulnerability details Impact The mint method is too centralized. Proof of Concept Using the mint function of ERC20MinterBurnerDecimals, the minter address can mint arbitrary amount of tokens. If the private key of the owner or minter address is compromised, the attacker will be able...

removeAddress doesn't decrease the contracts.length

Lines of code Vulnerability details Impact The contracts length will always increase because the removeAddress function just deleting the value inside the array and never decrease the length by calling pop method. This can lead to Dos when calling functions that doing loop on contracts storage:...

Sending batch withdrawal requests can possibly DoS

Lines of code Vulnerability details Impact The function BatchRequests.sendWithdrawalRequests allows calling the sendWithdrawalRequests function on all of the Yieldy contracts at once. However, due to the unbounded for loop, if many Yieldy contracts are added to contracts, this function can...

Malicious NFT

Lines of code Vulnerability details Impact Anybody can create a vault which fractionalizes their NFT. However, this process should go through a whitelist and review process because a maliciously implemented NFT contracts can reclaim ownership of the contract despite it technically being 'owned' b...

Proxy storage collision - contracts might be bricked

Lines of code Vulnerability details The proxy contracts save the implementation variables in the first storage slot see links above. This will lead to storage collusions when the implementation contract tries to read/update the first storage slot. For the implementation contract, the first storag...

MAL-2022-565 Malicious code in @robinhoodcoop/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79fa03f4a31da2397b472176a93488bd3d877f542dee8d065c78a2208255e065 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in token-registry-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb7c82a6c53a23b3bb67aacbe356d46f587a8d58c104fbef187519e4ad1f30ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6782 Malicious code in union-finance-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 864f2a7a59e93388fda46cda69a405d50e420ee9a3e50c40af312175b6a08850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in union-finance-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 864f2a7a59e93388fda46cda69a405d50e420ee9a3e50c40af312175b6a08850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2897 Malicious code in everest-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware daf5d08f81a8f2c17042f4d380e1b453cce7a49d9d7da863da126e8b4522be1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in everest-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware daf5d08f81a8f2c17042f4d380e1b453cce7a49d9d7da863da126e8b4522be1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1079 Malicious code in arbos-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6effb9213f79f35fea7e912b6bc7c9047b1815c7fc6c70ea532558d76ca20fff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arbos-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6effb9213f79f35fea7e912b6bc7c9047b1815c7fc6c70ea532558d76ca20fff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6566 Malicious code in tidal-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e47633a084020158369ef4e87e8387eb83ad513939de494380781ebe71b53f69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tidal-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e47633a084020158369ef4e87e8387eb83ad513939de494380781ebe71b53f69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-612 Malicious code in @status-waku-voting/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e07b2ca5cf7e5124b0b8dd678ddb944a08e63572048bba91cc3914aa17f1b31b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @status-waku-voting/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e07b2ca5cf7e5124b0b8dd678ddb944a08e63572048bba91cc3914aa17f1b31b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3294 Malicious code in gauntlet-solana-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf47fab99f01b2065d3cd02b4fdc2bd3fee465e263ab2b02b9e31f94c8ae5a6d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gauntlet-solana-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf47fab99f01b2065d3cd02b4fdc2bd3fee465e263ab2b02b9e31f94c8ae5a6d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ETH rescue does not work

Lines of code Vulnerability details Impact Both contracts InfinityExchange and InfinityStaker have a function rescueETH to allow an admin to rescue any ETH accidentally sent to the contracts. However, this ETH rescue functionality does not work. The code expects ETH to be sent to this function an...