Ingress nginx annotation injection causes arbitrary command execution

Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...

Unauthorized Ownership Transfer and Asset Withdrawal Vulnerability in quitSystem Function

Lines of code Vulnerability details Impact The quitSystem function in the contract is vulnerable to unauthorized asset control. This vulnerability arises when an allowed user, rather than the owner, exploits their permissions to perform unauthorized actions. Specifically, the allowed user can...

use of correct modifier

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps function...

Inherit a wrong contract - Authorizable.sol.

Lines of code Vulnerability details Risk rating high Title Inherit a wrong contract - Authorizable.sol. Vulnerability Details Impact By an untrust account, the system could be invaliable. Proof of Concept The Authorizable.soladdAuthorization and Authorizable.solremobeAuthorization functions as...

M-05 Unmitigated

Lines of code Vulnerability details Mitigation of M-05: Issue NOT mitigated Mitigated issue M-05: Reward sandwiching in VotiumStrategy The issue was that exposure to the benefits of the VotiumStrategy might be unfairly time-weighted. There were two aspects mentioned: voting power and rewards. I d...

Missing functionality required to allow others access to safe

Lines of code Vulnerability details Impact Missing functionality prevents ODProxy from granting other accounts access to the safe. In order to grant access to the particular safe for which specific instance of ODProxy is the owner, it is necessary to call allowSAFE on ODSafeManager. This method...

M-08 Unmitigated

Lines of code Vulnerability details Lines of code Vulnerability details Mitigation of M-08: Issue mitigated with ERROR Mitigated issue M-08: Inflation attack in VotiumStrategy The issue was that the price of afEth and of vAfEth could be inflated by donating underlying assets. Mitigation review Al...

During Safe Transfer, the Receiving User Loses Control of the Safe, Resulting in the Safe Being Lost

Lines of code Vulnerability details Impact Assuming a user wants to transfer their safe NFT to another user, post transfer Vault721::afterTokenTransfer is triggered. This function in turn calls the IODSafeManager::transferSAFEOwnership function to complete the transfer. The problem here is, that...

[ADRIRO-NEW-H-01] VotiumStrategy withdrawal can still be executed with minimal delay

Lines of code Vulnerability details Summary Within the mitigation changes, the sponsor has introduced a minimum delay of one epoch for VotiumStrategy withdrawals, in order to mitigate different issues related to the exposure to CVX . The fix contains an edge case which could still be used to make...

M-07 Unmitigated

Lines of code Vulnerability details Mitigation of M-07: Issue NOT fully mitigated with ERROR Mitigated issue M-07: Lack of access control and value validation in the reward flow exposes functions to public access The issue was that anyone can deposit rewards to AfEth, and that if AfEth or...

SafeID's ownership is not checked properly in BasicAction.generateDebt()

Lines of code Vulnerability details Impact the ownership of safe's id passed in BasicAction.generateDebt is never checked which can lead to unexpected results Proof of Concept BasicAction.generateDebt has the following code - function generateDebt address manager, address taxCollector, address...

[H-02] Mitigation error: Null Votium withdrawal requests are queued last

Lines of code Vulnerability details Description When a request to withdraw is placed such that VotiumStrategy.requestWithdraw0 is called, this queues it to the end of all previous withdrawal requests as if an infinitesimal amount is to be withdrawn, incurring an artificially prolonged withdrawal...

Wrong validation check for caller of some functions

Lines of code Vulnerability details Impact When an attacker call some functions which lacks validation check for msg.sender, it causes unexpected interactions. Proof of Concept The AccountingEngine.solsettleDebt function and AccountingEngine.solsettleDebtfuntion is as follows. function...

On repaying and taking collateral there is 2 times modifying tokenCollateral[cType][account/sourse]this lead to a problem

Lines of code Vulnerability details Impact when you are repaying your tokenCollateralcTypeaccount is modified 2 times, which leads to incorrect data Proof of Concept On calling repayAllDebtAndFreeTokenCollateral or repayDebtAndFreeTokenCollateral first you are calling modifySAFECollateralization...

correct use of safeAllowed modifier

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps function...

Introduce minEpoch to prevent withdrawal requests being front-runned

Lines of code Vulnerability details Original Issue M-04: VotiumStrategy withdrawal queue fails to consider available unlocked tokens causing different issues in the withdraw process Issue Details The issue raised above occured whenever there was an unlocked balance which could be used to fulfill...

at _modifyCollateralBalance when locking and generating debt your wad is going to be negative number but at the token Collateral mapping should not have any negative numbers

Lines of code Vulnerability details Impact the protocol will not work, all functions will not work Proof of Concept you cannot set negative number to uint256 Tools Used manual Recommended Mitigation Steps change the mapping to : mappingbytes32 cType = mappingaddress safe = int256 wad public...

Function _joinCollateral calculates variable wei incorrectly for collateral tokens that do not have 1e18 decimals

Lines of code Vulnerability details Impact Collateral tokens with decimals other than 1e18 will not work. Proof of Concept Function joinCollateral in CommonActions.sol, which is inherited by BasicActions.sol in scope calculates the collateral token amount wrongly for all non 1e18 decimal tokens...

H-01 Unmitigated

Lines of code Vulnerability details Mitigation of H-01: Mitigation Error, see comments Link to Issue: code-423n4/2023-09-asymmetry-findings62 Comments The sponsor has provided a detailed response in the following comment: code-423n4/2023-09-asymmetry-findings62 comment In summary their analysis i...

Delegating the call from ODProxy will make the changes in the context of ODProxy's storage layer which breaks the invariant.

Lines of code Vulnerability details Impact Making the delegate call to ODSafeManager will affect the storage of ODProxy leaving behind the inconsistent state in ODSafeManager, moreover this issue will also breaks the invariant 'Users must exclusively use the ODProxy to interact with their safes.'...