CVE-2022-24788

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns bytes generates bytecode which does not clamp bytes length, potentially resulting in a...

CVE-2022-24788 Buffer overflow in Vyper

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns bytes generates bytecode which does not clamp bytes length, potentially resulting in a...

CVE-2022-24788

CVE-2022-24788 affects Vyper up to version 0.3.2, where importing a function from a JSON interface returning bytes can generate bytecode that does not clamp bytes length, potentially causing a buffer overrun. A fixed version is 0.3.2; users should upgrade to this release. Several sources (e.g., R...

CVE-2022-24788 Buffer overflow in Vyper

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns bytes generates bytecode which does not clamp bytes length, potentially resulting in a...

Wrong authorization for CToken._setNameAndSymbol

Lines of code Vulnerability details Impact Anyone can change a CToken's name and symbol because of a wrong admin check: This will not only be very confusing for CToken holders but also allows many phishing attacks that will lead to loss of funds. For example, a victim holding both cWBTC and cUSDC...

CVE-2022-24787

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one en...

Design/Logic Flaw

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one en...

CVE-2022-24787 Incorrect Comparison in Vyper

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one en...

CVE-2022-24787

CVE-2022-24787 (Vyper) affects the Vyper language (Pythonic smart contract language for the EVM) in version 0.3.1 and earlier. The issue is that bytestrings can contain dirty bytes, causing word-for-word comparisons to yield incorrect results. Even without dirty nonzero bytes, two bytestrings may...

CVE-2022-24787 Incorrect Comparison in Vyper

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting in the word-for-word comparisons giving incorrect results. Even without dirty nonzero bytes, two bytestrings can compare to equal if one en...

System could be wrapped and made useless without contract whitelisting

Lines of code Vulnerability details Impact Anyone could create a contract or a contract factory "PAL Locker" with a fonction to deposit PAL tokens through a contract, lock them and delegate the voting power to the contract owner. Then, the ownership of this contract could be sold. By doing so,...

Incorrect implementation of the _startBridge function in CBridgeFacet

Lines of code Vulnerability details Impact The startBridge function in CBridgeFacet is to bridge the tokens to CBridge by calling the sendNative or send function on the bridge contract. However, when calling the sendNative function, no native token is sent to the bridge. The sendNative call alway...

if msg.value > amount , then extra eth is not transfered back to user

Lines of code Vulnerability details Impact if msg.value amount , there is no mechanism to send extra eth back due to which user will lose extra Proof of Concept function startBridgeTokensViaCBridgeLiFiData memory lifiData, CBridgeData calldata cBridgeData public payable if cBridgeData.token !=...

use of transfer() instead of call() to send eth

Lines of code Vulnerability details Impact Use of transfer might render ETH impossible to withdraw becuase after istanbul hardfork , there is increases in the gas cost of the SLOAD operation and therefore breaks some existing smart contracts.Those contracts will break because their fallback...

Denial Of Service (DoS)

Go-Ethereum is vulnerable to denial of service. An attacker is able to exploit the vulnerability and crash the system by sending an excessive amount of messages to a node...

GHSA-VRCC-G6VJ-MH5W Denial of service in go-ethereum

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service DoS via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go...

Denial of service in go-ethereum

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service DoS via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go...

CVE-2021-42219

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service DoS via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go...

CVE-2021-42219

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service DoS via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go...

CVE-2021-42219

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service DoS via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go...