disallowing the executor to sign the transaction with the expiryEpoch will may allow or prevent the transaction to be executed in a wrong time for the executor, who is the responsible for performing the strategies, and will hamper the automation process

Lines of code Vulnerability details Impact preventing the executor from setting an ExpiryEpoch to the transaction to be executed within it , will lead to hamper the automation process and may allow the transactions to be executed in improper time in which the strategy became invalid which may cau...

updateScore() is vulnerable to flashloan manipulation

Lines of code Vulnerability details Impact vToken.balanceOfuser can be manipulated by dong some flash loan of vToken. Proof of Concept A flash loan attack is a type of exploit that takes advantage of the fact that flash loans are uncollateralized and do not require a credit check. In a flash loan...

requestDeposit and requestRedeem do not allow for any price guarantee, opening users to sandwich attacks and other losses

Lines of code Vulnerability details Impact Request functions take only the desired input amount as a parameter, giving no way for the caller to control the fulfilment price. The price is decided by the Centrifuge mainnet only. function requestDeposituint256 assets, address owner; function...

defi-metiers.fr Cross Site Scripting vulnerability OBB-3634468

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Potential Reversion in Transfer due to LSP1 Interface Support Check

Lines of code Vulnerability details Impact The transfer function in LSP7DigitalAssetCore & LSP8DigitalAssetCore includes a mandatory hook, notifyTokenSender, which verifies if the sender supports INTERFACEIDLSP1. However, if a token owner who initially implemented LSP1 interface ceases to support...

Potential Reversion in Transfer due to LSP1 Interface Support Check

Lines of code Vulnerability details SORRY I HAVFE PREVIOUSLY SUBMITTED THIS ISSUE WITHOUT THE FIX... FIRST TIME WARDEN FORGIVE ME Impact The transfer function in LSP7DigitalAssetCore & LSP8DigitalAssetCore includes a mandatory hook, notifyTokenSender, which verifies if the sender supports...

Jimbos Protocol Hack: $7.5 Million Lost in Latest DeFi Attack

By Habiba Rashid The attack on Jimbos Protocol exploited a critical vulnerability related to the lack of slippage control on liquidity conversions. This is a post from HackRead.com Read the original post: Jimbos Protocol Hack: $7.5 Million Lost in Latest DeFi Attack...

Financial cyberthreats in 2022

Financial gain remains the key driver of cybercriminal activity. In the past year, weve seen multiple developments in this area – from new attack schemes targeting contactless payments to multiple ransomware groups continuing to emerge and haunt businesses. However, traditional financial threats ...

Risk of flashloan attacks in the Staking contract

Lines of code Vulnerability details Impact An attacker can steal a large amount of rewardsToken from the Staking contract by using flashloans, thus all the users will receive less rewards for their staked amounts. Proof of Concept In the Staking contract any user can stake a given amount of...

Could Bitcoin Be The Future Of DeFi?

By Waqas Bitcoin has both security and liquidity, and now, with the addition of smart contract capabilities, it has all the ingredients required for DeFi to take off. This is a post from HackRead.com Read the original post: Could Bitcoin Be The Future Of DeFi?...

Users have no guarantee of a minimum amount received when minting and redeeming

Lines of code Vulnerability details Impact It is a widely accepted practice in DeFi to offer users the ability to specify the least favorable exchange they are willing to accept. Since CASH tokens are not received in the same transaction it is not possible to create a wrapper that checks if they...

Pool.sol : Lack of slippage protection for swap

Lines of code Vulnerability details Impact Due to lack of slippage protection, user may suffer and incur loss of func in adverse condition. Proof of Concept Swap function is used to swap one toke for another token. While the swap function has check to ensure for exactOutput, but it does not have...

We Need Smarter Smart Contracts To Prevent DeFi Hacks

By Waqas The smart contracts that govern DeFi are littered with exploitable code, and hackers understand that since hundreds of millions of crypto funds have been siphoned off due to this very issue. This is a post from HackRead.com Read the original post: We Need Smarter Smart Contracts To Preve...

DeFi Startup AllianceBlock Debuts Trustless ID Verification Service For Dapps

By Waqas The new service is meant to solve the problem of trustlessly sharing identity data. This is a post from HackRead.com Read the original post: DeFi Startup AllianceBlock Debuts Trustless ID Verification Service For Dapps...

Cake DeFi Added Ethereum Staking Service to Allow Unstaking Anytime

By Waqas Singapore’s fastest-growing Fintech firm Cake DeFi has added Ethereum Staking service to its platform with 5 percent returns… This is a post from HackRead.com Read the original post: Cake DeFi Added Ethereum Staking Service to Allow Unstaking Anytime...

TIMELOCK_ROLE Can Withdraw FUND from the Contracts via recoverEther()

Lines of code Vulnerability details Impact The Timelock Address role is misidentified in this agreement and has high authority. While I believe developer have good intention to use these functions. It often associate with Rug Pull by developer in the eyes of investors because Rug Pull is not...

How DeFiChain gives DeFi a major boost with innovative decentralized assets

By Owais Sultan In this article, we’ll be exploring the landscape of DeFi, demonstrating how the recent DeFiChain developments are set to innovate the industry as a whole and drive the usability of DeFi. This is a post from HackRead.com Read the original post: How DeFiChain gives DeFi a major boo...

Crypto Trading Firm Wintermute Loses $160 Million in Hacking Incident

In what's the latest crypto heist to target the decentralized finance DeFi space, hackers have stolen digital assets worth around $160 million from crypto trading firm Wintermute. The hack involved a series of unauthorized transactions that transferred USD Coin, Binance USD, Tether USD, Wrapped...

U.S. Seizes Cryptocurrency Worth $30 Million Stolen by North Korean Hackers

More than $30 million worth of cryptocurrency plundered by the North Korea-linked Lazarus Group from online video game Axie Infinity has been recovered, marking the first time digital assets stolen by the threat actor have been seized. "The seizures represent approximately 10% of the total funds...

defi-sagesse.fr Cross Site Scripting vulnerability OBB-2850505

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...