PT-2023-25768 · Unknown · Aqua Drive

Name of the Vulnerable Software and Affected Versions: Aqua Drive version 2.4 Description: The issue allows an authenticated non-privileged user to access or modify stored resources of other users through a relative path traversal vulnerability. It could also be possible to access and modify the...

Wrong calculation of APR in certain conditions.

Lines of code Vulnerability details Impact The wrong APR due to the miscalculation of effective distribution speed. Proof of Concept The functions Prime.sol/calculateAPR and Prime.sol/estimateAPR both uses the function calculateUserAPR which uses incomeDistributionYearly function. Now this functi...

Gas Limit Issues/DoS with Block Gas Limit

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Iterating through the users array without a limitation might cause the function to consume a lot of gas, especially when the array size is large. It may potentially reach the block gas limit and get...

Lack of Access Control for Critical Functions

Lines of code Vulnerability details Impact Several critical functions within the Prime contract lack proper access control mechanisms. These functions handle sensitive operations, making the contract vulnerable to unauthorized access and potential exploits. Proof of Concept Tools Used Manual...

calculateAPR and estimateAPR may return invalid results

Lines of code Vulnerability details Impact The capitalForScore function in the Prime contract calculates the capital for calculation of score using a price oracle. The function is called three times inside of the contract, where only in the calculateScore is the oracle updated using the following...

Single Failure in claim() Reverts Entire Transaction

Lines of code Vulnerability details Impact When the claim function is called it calls internally initializeMarketsmsg.sender which then loops through the whole market and other functions involving the user passed as parameter, the problem is that if one single thing fails everything will fail and...

Loss of interests due to loss of precision

Lines of code Vulnerability details Impact Users can lose accrued interest due to loss of precision during calculation. It is possible that the interestsvTokenuser.rewardIndex is changed and the interestsvTokenuser.accrued is never increased. Proof of Concept The interestsvTokenuser.rewardIndex a...

Missing Access Control in setLimit Function

Lines of code Vulnerability details Impact The setLimit function does not have proper access control, allowing anyone to modify the revocableLimit and irrevocableLimit variables. This can lead to potential security risks and unintended changes to these limits. Proof of Concept no access control o...

The prime Initializer function in prime.sol is marked “virtual”

Lines of code Vulnerability details Impact The prime initializer is responsible for setting the state variables in the prime.sol contract. The deal breaker here is; Use of virtual - If the function in the parent contract is expected to be overridden in its child contracts, it should be declared a...

Users can claim double the interest than they are supposed to.

Lines of code Vulnerability details Impact A malicious user can claim double the amount of interest by calling accrueInterestAndUpdateScore function before calling claimInterestfunction. This can result in direct loss of funds for the protocol and hence the high severity. Proof of Concept 1. The...

Prime.sol : Incorrect decimal scaling

Lines of code Vulnerability details Impact Incorrect computation of the capital variable due to an incorrect decimal scaling. This directly impacts the computation of user's score. PoC The function calculateScore calculates the score for a given user and a given market. One of the core variables ...

Potential Blacklisting from Accepting Tainted Tokens

Lines of code Vulnerability details Impact The contract can store practically any token, the problem is that some tokens have to be compliant with authorities and because of that they can and probably will add the contract's address to their blacklist if any tainted token is sent to it, here it i...

A malicious user can reduce a staker's rewards

Lines of code Vulnerability details Impact A user's interest is accrued through the executeBoost function, which calls interestAccrued which performs calculations on how much the user has accrued. Said calculations are made by subtracting the user's rewardIndex from the current market rewardIndex...

Prime.sol: stakedAt value is not deleted when manually issuing an irrevocable token

Lines of code Vulnerability details Impact Protocol specifications state that a user cannot have less than the minimum xvs staked if they are not irrevocable prime token users. In other words, only holders of irrevocables prime tokens can have less than the minimum xvs staked. The problem arises...

Wrong estimation of _incomeDistributionYearly

Lines of code Vulnerability details Impact Incorrect estimation of incomeDistributionYearly due to an uncertain assumption, leading to wrong APR estimation. Proof of Concept ... uint256 totalIncomePerBlockFromPLP = IPrimeLiquidityProviderprimeLiquidityProvider...

pendingScoreUpdates counts may be corrupted

Lines of code Vulnerability details Vulnerability details Prime.pendingScoreUpdates is used to record the number of users whose score needs to be recalculated when addMarket , updateAlpha , updateMultipliers occurs. Record pendingScoreUpdates=totalIrrevocable + totalRevocable when the above metho...

accrueTokens will revert if any rebase tokens are used

Lines of code Vulnerability details Impact In PrimeLiquidityProvider.sol:accrueTokens we get the current balance of the passed token. If the token is any rebase token AMPL, stETH, RMPL and the current balance has become lower than tokenAmountAccruedtoken, the function will revert. This will lead ...

Staking period reset to zero

Lines of code Vulnerability details Impact The claim function checks if the user has staked 1,000 XVS for 100 days and then sets stakedAtmsg.sender = 0.Meaning, it sets the staked period for that certain user to zero. Then,it calls the mint function.The mint function then checks if the user alrea...

CVE-2023-4911

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBCTUNABLES environment variables when launching binaries with SUID permission to execute code...

WordPress Product Category Tree Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Software Product Category Tree Type Plugin Vulnerable versions = 2.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-45054 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID dfaa06e092f0 Credits Le Ngoc Anh...