4437 matches found
CVE-2021-41153
The evm crate (Rust Ethereum VM)
CVE-2021-41153 Specification non-compliance in JUMPI
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In evm crate 0.31.0, JUMPI opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. This is a...
Incorrect checking of signature length
Handle JMukesh Vulnerability details Impact signature which have SignatureMode.EthSign/SignatureMode.EIP712 have length 65 , so all signature coming through both mode will be reverted Proof of Concept Tools Used manual review Recommended Mitigation Steps update the correct signature length --- Th...
evm crate ĺŽĺ ¨ćźć´
evm crate is a Rust Ethereum virtual machine implementation. A security vulnerability exists in evm crate that stems from a condition in evm crate where the JUMPI opcode is checked after a destination validity check...
cancel() calculates hashTx in the wrong way
Handle gpersoon Vulnerability details Impact The function cancel of contract QuickAccManager uses the wrong way to calculate the hash that has to be cancelled. It uses: "bytes32 hashTx = keccak256abi.encodeaddressthis, block.chainid, accHash, nonce, txns;" Where it should use "bytes32 hash =...
GHSA-VJ62-G63V-F8MF Validity check missing in Frontier
Impact In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block...
CVE-2021-41138
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of...
CVE-2021-41138
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of...
CVE-2021-41138
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of...
Input validation
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of...
CVE-2021-41138 Validity check for signed Frontier-specific extrinsic not called in block execution
Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for pallet-ethereum, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of...
CVE-2021-41138
CVE-2021-41138 concerns Frontier, Substrateâs Ethereum compatibility layer. A signed Frontier-specific extrinsic for pallet-ethereum caused many validation checks to run only during transaction pool validation, not during block execution, allowing malicious validators to include invalid transacti...
OpenSea âFree Giftâ NFTs Drain Cryptowallet Balances
Users of OpenSea, the worldâs largest digital-collectible marketplace, have found their cryptocurrency wallets ripped off thanks to cyberattackers weaponizing security bugs that allowed them to highjack user accounts. The attacks revolved around boobytrapped art files, which circulated in the for...
Frontier čžĺ ĽéŞčŻé误ćźć´
Frontier is an EtherCompatible layer for Substrate. It is used to run unmodified ethereum dapps. Frontier suffers from an input validation error vulnerability, which stems from the fact that a large portion of the transaction validation logic in the recently introduced signed Frontier-specific...
Vyper çźĺ˛ĺşé误ćźć´
Vyper is the Pythonic smart contract language for EVM. Vyper suffers from a buffer error vulnerability that stems from an incorrect pointer to the top of the stack, which can lead to memory corruption issues...
Compound DeFi Platform Gives Out $90M
Compound, an Ethereum-based decentralized finance DeFi platform, accidentally gave out $90 million to its users in a botched upgrade. Now, the owners would appreciate it if they gave it back. Compound might even be willing to throw in a 10 percent âreward,â it said. On the flip side, those who...
Userâs Ether may get left behind in the Router
Handle 0xRajeev Vulnerability details Impact If the user deposits less ETH than claimed by the params.tokenIn for native functions, then wETH is transferred from the msg.sender to pool, while the user's ETH is left behind in the Router. Proof of Concept Tools Used Manual Analysis Recommended...
Use of transfer() instead of call() to send eth
Handle JMukesh Vulnerability details Impact Use of transfer might render ETH impossible to withdraw becuase after istanbul hardfork , there is increases in the gas cost of the SLOAD operation and therefore breaks some existing smart contracts.Those contracts will break because their fallback...