MAL-2024-1002 Malicious code in erc20-testenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ba12fa784008a111d1c5f54bbb19cf4807564ce4e06434d4a10eae96767350a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

L1 TO L2 ERC20 TOKEN TRANSFER CAN BE DoS IN THE FxERC20ChildTunnel CONTRACT SINCE A MALICIOUS USER CAN SET THE fxRootTunnel ADDRESS TO AN INVALID ADDRESS

Lines of code Vulnerability details Impact The FxERC20ChildTunnel is a smart contract which is used for the L2 token management. The FxERC20ChildTunnel contract inherits from the FxBaseChildTunnel contract. The FxBaseChildTunnel contract has the validateSender modifier which requires the sender o...

Upgraded Q -> 2 from #549 [1704652745528]

Judge has assessed an item in Issue 549 as 2 risk. The relevant finding follows: L-02 The first piece created can pass quorumVotes without any votes if totalSupply of ERC20 votes is zero --- The text was updated successfully, but these errors were encountered: All reactions...

Delegation to address(0) causes permanent loss of voting power

Lines of code Vulnerability details Impact As stated in the comment on line 12 of NontransferableERC20Votes.sol, delegation of vote power can be done through the delegate function or by providing a signature to be used with delegateBySig. However, these functions do not prevent users from...

Decimals of LendingPool don't take into account the offset introduced by VIRTUAL_SHARES

Lines of code Vulnerability details Impact The impact of this finding is more on the marketing/data fetching side, on exchanges it would appear that the shares are worth less VIRTUALSHARES than the underlying token. Given that it would influence the perception of the value of the shares token,...

In some pools, borrowers can maliciously prevent liquidatePosition()

Lines of code Vulnerability details Vulnerability details in liquidatePosition At the end of the liquidation, the liquidation fee will be transferred to the liquidator. function liquidatePosition DataStruct.ClosePositionParams calldata params, address borrower external override nonReentrant...

Zero amount token transfers may cause a denial of service during liquidations

Lines of code Vulnerability details Summary Some ERC20 implementations revert on zero value transfers. Since liquidation rewards are based on a fraction of the available position's premiums, this may cause an accidental denial of service that prevents the successful execution of liquidations...

Liquidation is not possible if trader blacklisted from blacklistable ERC20 token

Lines of code Vulnerability details Impact If a trader is blacklisted from a blacklistable ERC20 token while has an open position, it may not be possible to liquidate the position. Proof of Concept When liquidate position, it will eventually calculate the amount of token that need to be send to...

Unsafe use of transfer()/transferFrom() with IERC20

Lines of code 377, 509, 491, 530, 42, 50 Vulnerability details Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's transfer and transferFrom functions on L1 do not return booleans as the specification...

Unsafe use of transfer()/transferFrom() with IERC20

Lines of code 377, 509, 491, 530, 42, 50 Vulnerability details Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's transfer and transferFrom functions on L1 do not return booleans as the specification...

OverInflation or OverDeflation of Value of ERC20 tokens with unequal Wrap and Unwrap Token Decimal

Lines of code Vulnerability details Impact Due to wrong parameter arrangement of convertDecimals... function call during the course of wrap and unwrap of erc20 token function call, OverInflation or OverDeflation of Value of ERC20 tokens with unequal Wrap and Unwrap Token Decimal which would cause...

Reentrancy in Token Transfers

Lines of code Vulnerability details Impact The mint and burn functions perform ERC20 token transfers without implementing a reentrancy guard. This allows malicious approving contracts to call back into these functions during a transaction and manipulate state. An attacker could steal all approved...

Lack of access control for mint/burn functions

Lines of code Vulnerability details Impact The mint and burn functions allow any caller to mint and burn tokens without restrictions. This could enable malicious actors to arbitrarily inflate or reduce the token supply. An attacker could continuously mint new tokens, effectively devaluing all...

Creator can earn holder fee

Lines of code Vulnerability details Impact Creator can earn creator and holder as well. Proof of Concept In market.sol contract there is a buy function which cannot be used by creator of share. requireshareDataid.creator != msg.sender, "Creator cannot buy"; However, it's still possible for creato...

Upgraded Q -> 2 from #221 [1699029747725]

Judge has assessed an item in Issue 221 as 2 risk. The relevant finding follows: L-02 Handling missing for case where ERC20 token has decimal 18 in CamelotRelayer & UniV3Relayer oracles Description In the constructor token decimals of an ERC20 is assumed to be = 18 which can be wrong for some...

Circumvention of soft staking restrictions in StakedUSDeV2 through indirect ERC20 token transfers

Lines of code Vulnerability details Summary The StakedUSDeV2 in the Ethena protocol is designed to allow users to stake USDe tokens and earn rewards. The protocol includes roles and restrictions to manage the staking process, such as SOFTRESTRICTEDSTAKERROLE and FULLRESTRICTEDSTAKERROLE. However,...

There is no check for collateral token in mint matches same in withdraw

Lines of code Vulnerability details Impact While we understand that usde is the base token here, we see that on minting used token you would need to transfer some tokens to the contract and get some used minted to you and on redemption get usde burnt to get a token sent back to you. The implicati...

Tokens having Fee-On-Transfer are not considered which will make the protocol in retaining less value than expected.

Lines of code Vulnerability details Impact The balance of the custodian Addresses will be smaller than what is expected, making the protocol fail to maintain the delta neutral position. Proof of Concept The function EthenaMinting.sol/transferCollateral is sending the tokens using safeTransferFrom...

Unchecked return value when calling ERC20's transfer function inside withdraw function of USDeSilo.sol. It is unsafe transfer of ERC20 tokens.

Lines of code Vulnerability details Summary In withdraw function of USDeSilo.sol there is one call calling ERC20 transfer function on USDe token. And it's return value neither checked nor safeTransfer of SafeERC20 used . So whenever transfer fails then it will not revert. And result in wrong...

USER WILL SEND TRANSACTION GAS WHICH IS ONLY ENOUGH TO EXECUTE StakedUSDeV2.unstake FUNCTION SUCCESFULLY BUT NOT ENOUGH TO FULLY EXECUTE THE silo.withdraw THUS LOSING ALL USER FUNDS

Lines of code Vulnerability details Impact The StakedUSDeV2.unstake function is used to claim the staking amount after the cooldown period has finished. The unstake function will reset the userCooldown.cooldownEnd and userCooldown.underlyingAmount parameters to 0 for the msg.sender once the cool...