The Ether for an LPDA mint sale can be locked in the LPDA contract indefinitely

Lines of code Vulnerability details Impact After a mint sale using LPDA, all the Ether can be locked in the LPDA contract indefinitely. Proof of Concept In the src/minters/ contracts, the .transfer function is used for sending Ether. It is used for sending fees to the feeReceiver, and in the...

Need to check the _mint() status before increment the token count .

Lines of code Vulnerability details Impact Its possible to increase the tokenIdTracker even mint function failed. The mint status must be checked before increment tokenIdTracker value . Proof of Concept function registeraddress recipient public onlyUnregistered returns uint256 tokenId address...

_expectMint is not checked when tokenId != 0

Lines of code Vulnerability details Impact In the mintBestAvailableTier function from the JBTiered721Delegate contract the expectMint variable is used to determine if the user is expecting the contract to mint tokens with the left over funds or not, but the boolean value of expectMint is only...

Loss of user funds by balance manipulation

Lines of code Vulnerability details Impact Breaking of the accounting logic, loss of user funds Proof of Concept The project uses LBPair's mint function to mint LBTokens to the user with additional safety checks when the user provides liquidity to the pair...

Self-transferring LBToken can lead to unlimited mint

Lines of code Vulnerability details Impact The implementation of the transfer function in LBToken.sol doesn't check for self-transfers, leading to users being able to mint an unlimited amount of tokens to themselves. The function caches the balance of the sender L182 and receiver L188 before addi...

didPay() receives payment but does not mint NFT to beneficiary as expected.

Lines of code Vulnerability details Impact The function JB721Delegate.didPay is expected to mint an NFT to the beneficiary if conditions are met. However the function only receives payment through payable, but does nothing else in the processPayment call if function does not revert. The expected...

Owner can set contribution floor to 0 , meaning the user lose the fund / fee for 0 contribution power NFT and NFT have no redemption weight

Lines of code Vulnerability details Impact Owner can set contribution floor to 0, meaning the user lose the fund / fee for 0 contribution power NFT and NFT have no redemption weight. the normal payment flow for user is Payment Terminal - pay - didPay - processPayment - // Mint rewards if they wer...

Warpinator 后置链接漏洞

Warpinator is an open source file sharing library for Linux Mint that shares files across a LAN. Files are sent and received over the local network. A security vulnerability exists in Warpinator that stems from allowing access to directories other than those intended, such as symbolic directory...

After pool is initialized, user can perform a sandwich attack through front-running and back-running mint transaction by calling swap function twice to manipulate initial price to be much different than market price and gain much more of output token than expected

Lines of code Vulnerability details Impact After the following initialize function is called, the pool does not own any of the tokens at that moment since the mint function below is not called yet. When the mint transaction is sent, a malicious user can notice it in the mempool and front-run it b...

the validator would able to manipulate the Time Stamp ant

Lines of code Vulnerability details Impact attacker able to make manipulation in the function of pageprice Proof of Concept validators can make some manipulation in the timestamp. bob validator even if can make time stamp manipulation or 2 secend able to call function faster than others then mint...

The mintLegendaryGobbler function does not delete the getApproved of the normal Gobbler, which would cause the sacrificed Gobbler to be transferred

Lines of code Vulnerability details Impact In the mintLegendaryGobbler function, the getApproved of the normal Gobbler is not deleted when the normal Gobbler is used to mint the legendary Gobbler, which results in the sacrificed Gobbler being able to be transferred in the transferFrom function. f...

admin still can mint token even if limit is reached

Lines of code Vulnerability details Impact In VariableSupplyERC20Token.sol theres a mint function that can be operate only by admin. The function should operate in 2 ways. IF maxSupplywas declared inconstructor, the admincan only mint as long as the token less thanmaxSupply/mintableSupply. OR IF...

VariableSupplyERC20Token cannot be deployed due to wrong access control

Lines of code Vulnerability details Impact VariableSupplyERC20Token contract cannot be deployed resulting in not functioning contract. Proof of Concept mint function is called in the constructor of VariableSupplyERC20Token contract. constructorstring memory name, string memory symbol, uint256...

Previously nominated delegate can reset the delegation

Lines of code Vulnerability details burn allows for previously recorded delegate to set himself to be contributor's delegate even if another one was already chosen. This can be quite material as owner choice for the whole voting power is being reset this way to favor the old delegate. Proof of...

Mint function on the simplefeidaiPSM() might DOS

Lines of code Vulnerability details Impact While a user call mint function it imediately mint fei token by supplying DAI and when a user redeem a token the fei will be transfered to this contract without burning the fei token, this could lead DOS if the total supply of the fei token reach the...

FEI Minter can drain SimpleFeiDaiPSM contract DAI balance

Lines of code Vulnerability details Impact The FEI token contract contain a mint function which allow the MINTER to mint a given amount of FEI tokens to any account including his own address. So the Minter can mint to his own account an amount of FEI tokens equivalent to the SimpleFeiDaiPSM...

The mint function is missing the minAmountOut control, this will cause the user to lose their funds.

Lines of code Vulnerability details Impact The mint function of the SimpleFeiDaiPSM contract receives DAI from the user, mints the FEI and sends it to the user. amountIn argument ; the amount of DAI received from the user, minAmountOut argument ; requests output for the amount of FEI given to the...

Governance: users cannot endorse if they voted, which may cause deadlock

Lines of code Vulnerability details Impact It may cause a deadlock situation Condition: there is no proposal with enough endorsement majority depending on the endorsement threshold of votes are locked in the current proposal The votes for the current proposal are balanced between for and against ...

Creator can be incorrectly paid because of array truncate when distributing mint fee.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The creatorRecipient and creatorShares can be forcefully trancated to a fixed length. And the truncated creator is not paid. Proof of Concept Provide direct links to all referenced code in GitHub. Add...

melbournemintgold.com.au Cross Site Scripting vulnerability OBB-2834398

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...