HIGH: ETH is forever locked in GiantMevAndFeesPool due to unaccepted burn()

Lines of code Vulnerability details Description GiantMevAndFeesPools and StakingFundsVault implement beforeTokenTransfer transfer hooks. StakingFundsVault.sol: function beforeTokenTransferaddress from, address to, uint256 external override address syndicate = liquidStakingNetworkManager.syndicate...

Tx should revert when the call in _returnDust failed

Lines of code Vulnerability details Impact User may lose remaining ETH of the transaction Proof of Concept As the returned status of the call in returnDust is ignored, the tx will success even if the call failed, which means the caller does not get his ETH back. Tools Used n/a Recommended...

Theft of ETH that was not used for the successful execution of orders

Lines of code Vulnerability details Description There are execute and bulkExecute functions in Exchange smart contract. There is the refund of any ETH that was unused for example that was left due to the unsuccessful order execution at the end of its execution flow: returnDust; returnDust functio...

Tokens and ETH can be sweeped from LooksRareAggregator

Lines of code Vulnerability details Impact Tokens and ETH can be sweeped from LooksRareAggregator Proof of Concept A malicious user may transfer out any tokens or ETH that are owned by LooksRareAggregator. To do so, a such user has to call execute - and make the trade. After executing of order...

Theft of ETH that was not used for successful execution of orders in non-atomic execution

Lines of code Vulnerability details Description There is an execute function in LooksRareAggregator contract. It refunds any ETH that was unused for example that left due to the unsuccessful execution of an order at the end of its execution flow: returnETHIfAnyoriginator; returnETHIfAny function ...

Loss of user funds

Lines of code Vulnerability details Impact The LooksRareAggregator contract can receive ether but cannot return it unless through the returnERC20TokensIfAny or returnETHIfAny function. This means that there is a scenario where a user can accidentally transfer funds to this contract and those fund...

ERC20 and ETH might be returned back to the wrong originator

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Assume the address of erc20EnabledLooksRareAggregator was maliciously changed to fakeerc20EnabledLooksRareAggregator during an execution of LooksRareAggregator.execute then, the malicious user might for...

BLOCK_PERIOD is incorrect

Lines of code Vulnerability details The BLOCKPERIOD is set to 13 seconds in Config.sol. uint256 constant BLOCKPERIOD = 13 seconds; Since moving to Proof-of-Stake PoS after the Merge, block times on ethereum are fixed at 12 seconds per block slots. . Impact This results in incorrect calculation of...

Lack of notice period for critical operations

Lines of code Vulnerability details Impact All user assets can be locked or stolen. Proof of Concept All user assets can be locked or stolen if the L1ERC20Bridge or L1EthBridge is upgraded to a malicious contract. All user assets can be locked or stolen if governor is lost and...

ergs price problem

Lines of code Vulnerability details No mechanism has been defined for " l2TransactionBaseCost" function. On the other hand, any Oracle is not used in the whole project to get the price of gas, so this whole project will suffer in coordinating between the price of “ergs” in ZK layer and the real a...

Unchecked array length of the public_inputs[] in Verifier.sol

Lines of code Vulnerability details Impact If an array enumerates all registered addresses, an adversary can register many addresses, causing the problem described above. Vulnerability Details Ethereum is a very resource-constrained environment. Prices per computational step are orders of magnitu...

Unchecked array lenght

Lines of code Vulnerability details Impact If an array enumerates all registered addresses, an adversary can register many addresses, causing the problem described above. Description Ethereum is a very resource-constrained environment. Prices per computational step are orders of magnitude higher...

etclient (0.3.0), eth-utils (>=0.1.1, <=0.2.0) +32 more potentially affected by CVE-2022-39354 via evm (>=0.7.1, <=0.33.1)

evm CARGO version =0.7.1, =0.1.1, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.11.0-beta.0, =0.7.0, =1.0.0, =1.0.0, =2.1.0 and more Source cves: CVE-2022-39354 Source advisory: OSV:GHSA-HHC4-47RH-CR34...

CVE-2022-39354

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...

Design/Logic Flaw

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...

RUSTSEC-2022-0083 evm incorrect state transition

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...

evm incorrect state transition

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...

HolographERC20 breaks composability by forcing usage of draft proposal EIP-4524

Lines of code Vulnerability details Description HolographERC20 is the ERC20 enforcer for Holograph. In the safeTransferFrom operation, it calls checkOnERC20Received: if isEventRegisteredHolographERC20Event.beforeSafeTransfer requireSourceERC20.beforeSafeTransferaccount, recipient, amount, data;...

Recursive call attack of the fallback function of Holographer

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The fallback function will forward all calls except those that appear in Holographer to the HolographerEnforcer which is obtained by calling address holographEnforcer = getHolographEnforcer; However, if...

CVE-2022-39354 evm has incorrect is_static parameter for custom stateful precompiles

SputnikVM, also called evm, is a Rust implementation of Ethereum Virtual Machine. A custom stateful precompile can use the isstatic parameter to determine if the call is executed in a static context via STATICCALL, and thus decide if stateful operations should be done. Prior to version 0.36.0, th...