4437 matches found
CVE-2021-43668
Go-Ethereum 1.10.9 nodes crash denial of service after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal...
CVE-2021-43668
Go-Ethereum, version 1.10.9, is affected by a vulnerability that can cause a denial-of-service crash. The issue manifests as a runtime error: invalid memory address or nil pointer dereference, leading to a SEGV signal after the node processes a sequence of messages and cannot recover. The provide...
Ethereum Go-ethereum 代码问题漏洞
Ethereum Go-ethereum is a codebase from the Ethereum community that implements the ethereum protocol in the Go language. A code issue vulnerability exists in Go-Ethereum 1.10.9 that allows attackers to conduct denial of service attacks...
Passing multiple ETH deposits in orders array will use the same msg.value many times
Handle hyh Vulnerability details Impact Contract holdings can be emptied as malicious user will do deposit/withdraw to extract value. This is possible because after transferInputTokens system uses contract balance for user's operations, assuming that equivalent value was transferred. Proof of...
pricePerShare is only lazily updated
Handle cmichel Vulnerability details The pricePerShare value is cached in updatePricePerShare and this value can be old and not reflect the actual core.pricePerShare value. The same issue exists on the sidechain variant when oracle price updates happen infrequently. This leads to potentially big...
Ethereum wibBTC price per share dependant on being updated every X time, but contract has no checks whether price is updated
Handle loop Vulnerability details The price of pricePerShare in WrappedIbbtcEth.sol is dependant on two things: The pricePerShare of core. updatePricePerShare being invoked every X time to update the pricePerShare of wibBTC. The only time updatePricePerShare is invoked inside the contract is duri...
Lack of data validation in update function
Handle Koustre Vulnerability details Impact There is no data validation of the data input into update function in MochiCSSRv0.sol. Allowing anyone to set the price of any non ERC20 token that is not a bluechip asset DAI, WETH, ETH, etc. Proof of Concept Provide direct links to all referenced code...
CVE-2021-41173
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside fro...
CVE-2021-41173
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside fro...
CVE-2021-41173
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside fro...
Design/Logic Flaw
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside fro...
CVE-2021-41173
CVE-2021-41173 affects go-ethereum prior to v1.10.9, where processing a malicious snap/1 message could crash a node (DoS). The Red Hat and OSV details corroborate a crash in Go Ethereum’s P2P handling, specifically the GetTrieNodes path in the snap protocol. The root cause involved unsafe handlin...
CVE-2021-41173 DoS via maliciously crafted p2p message
Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node is susceptible to crash when processing a maliciously crafted message from a peer. Version v1.10.9 contains patches to the vulnerability. There are no known workarounds aside fro...
Transfer function is unreliable
Handle Koustre Vulnerability details Impact Opcode pricing is not stable and should not be relied upon to protect against re-entrancy attacks. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept...
transfer() is not recommended for sending ETH
Handle WatchPug Vulnerability details Since the introduction of transfer, it has typically been recommended by the security community because it helps guard against reentrancy attacks. This guidance made sense under the assumption that gas costs wouldn’t change. It's now recommended that transfer...
use of transfer() instead of call() to send eth
Handle JMukesh Vulnerability details Impact Use of transfer might render ETH impossible to withdraw becuase after istanbul hardfork , there is increases in the gas cost of the SLOAD operation and therefore breaks some existing smart contracts.Those contracts will break because their fallback...
.transfer is used for transferring ether
Handle pauliax Vulnerability details Impact payablemsg.sender.transfertoTransfer; feeRecipient.transferaddressthis.balance; It is no longer recommended to use .transfer when sending ether as recipients with custom fallback functions smart contracts will not be able to handle that. You can read mo...
CVE-2021-42766
The Proof-of-Stake PoS Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service long-range consensus chain reorganizations, even when this adversary has little stake and cannot influence network message propagation. This can cause a protocol stall, or an...
CVE-2021-42764
The Proof-of-Stake PoS Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service delayed consensus decisions, and also increase the profits of individual validators, via short-range reorganizations of the underlying consensus chain...