CVE-2023-40591 Denial of service via malicious p2p message in go-ethereum

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version 1.12.1-stable, i.e,...

CVE-2023-40591 Denial of service via malicious p2p message in go-ethereum

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node, can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. The fix is included in geth version 1.12.1-stable, i.e,...

Ethereum Go-ethereum Resource Management Error Vulnerability

Ethereum Go-ethereum is a codebase from the Ethereum community that implements the Ethereum protocol in the Go language. A resource management error vulnerability exists in Ethereum Go-ethereum version 1.10.0, which stems from unlimited memory consumption...

arbitrum block.number refers to L1 block number, not L2 block number when determining the round

Lines of code Vulnerability details Impact arbitrum block.number refers to L1 block number, not L2 block number Proof of Concept In the current implementation, the round manager use block.number to determine the round However, according to the block.number in arbitrum refers to ethereum mainnet...

PT-2023-27526 · Unknown · Go-Ethereum

Name of the Vulnerable Software and Affected Versions: go-ethereum geth versions prior to 1.12.1-stable Description: A vulnerable node can be made to consume unbounded amounts of memory when handling specially crafted p2p messages sent from an attacker node. This occurs because the p2p handler...

World’s Largest Cryptocurrency Casino Stake Hacked for $41 Million

By Deeba Ahmed Ethereum Network Stake Loses $41 Million Worth of Crypto After Private Key Leak. This is a post from HackRead.com Read the original post: Worlds Largest Cryptocurrency Casino Stake Hacked for $41 Million...

Condition will not revert when block.timestamp is == to the compared variable

Lines of code Vulnerability details Medium Issues | | Issue | Instances ---|---|--- M-1 | Condition will not revert when block.timestamp is == to the compared variable | 1 M-1 Condition will not revert when block.timestamp is == to the compared variable The condition does not revert when...

Investing in Ethereum Blockchain-based JasmyCoin: Guide

By Owais Sultan JasmyCoin operates on blockchain technology as a decentralized digital currency, ensuring secure and transparent transactions. This is a post from HackRead.com Read the original post: Investing in Ethereum Blockchain-based JasmyCoin: Guide...

Investing in Ethereum Blockchain-based JasmyCoin: Guide

By Owais Sultan JasmyCoin operates on blockchain technology as a decentralized digital currency, ensuring secure and transparent transactions. This is a post from HackRead.com Read the original post: Investing in Ethereum Blockchain-based JasmyCoin: Guide...

Upgraded Q -> 3 from #264 [1691857350267]

Judge has assessed an item in Issue 264 as 3 risk. The relevant finding follows: Let's see how it can be exploited. You can add this test to Withdraw.t.sol and run with forge test -vv --match-contract VaultWithdrawTest --match-test testWithdrawAllAssetsForHalfShares: function...

Missing validation to ensure that the _l2CoreGovTimelock parameter is not the zero address in the initialize function

Lines of code Vulnerability details Impact The initialize function accepts a parameter l2CoreGovTimelock and does check if it's a contract address using Address.isContract. However, there's no explicit check to ensure that l2CoreGovTimelock is not the zero address...

Malicious code in ethereum-cryptographyyy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb7593ecb796620e3c4b6e3e5b66e8e7efa0ddd8ce6cfab3c8e0cca35c62ce96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1057 Malicious code in ethereum-cryptographyyy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb7593ecb796620e3c4b6e3e5b66e8e7efa0ddd8ce6cfab3c8e0cca35c62ce96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-39363

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

Xxe

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363 Vyper incorrectly allocated named re-entrancy locks

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in...

CVE-2023-39363

Vyper CVE-2023-39363 vulnerability: in Vyper versions 0.2.15, 0.2.16, and 0.3.0, named re-entrancy locks are allocated per function, not per key, enabling cross-function re-entrancy when a contract uses @nonreentrant with a specific key and path-dependent state updates before storage (breaking ch...

CVE-2023-38698

Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...