CVE-2023-32005

A vulnerability was found in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used with a non- argument. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.statfs API. As a result, malicious actors ca...

User funds can be lost

Lines of code Vulnerability details Impact User funds sent by users can be lost forever Proof of Concept The contract LendingLedger.sol implements the function receive external payable to allow to the protocol to deposit the Canto used in the expected behaviour. But since the receive external...

replaceMember and rotateMember redundancy

Lines of code Vulnerability details Impact The replaceMember and rotateMember functions have identical functionality which may lead to redundancy and confusion. Proof of Concept Both the replaceMember and rotateMember functions essentially perform the same action: replacing a current member...

Potential Overflow Bug in sync_ledger Function

Lines of code Vulnerability details Impact The syncledger function in the provided Solidity smart contract is vulnerable to potential overflow issues when processing a large value for the delta parameter. Depending on the magnitude of the delta value, the contract may encounter various undesired...

Missing validation for the _l1TimelockMinDelay parameter in the constructor to ensure it's within a reasonable or expected range.

Lines of code Vulnerability details Impact The constructor accepts a parameter l1TimelockMinDelay and assigns it to l1TimelockMinDelay without performing any validation checks. This means potentially erroneous or extreme values can be set, which could cause undesired behaviors in the system or op...

L1SCMgmtActivationAction does not check executor role of new and prev emergency security council

Lines of code Vulnerability details Proof of Concept GovernanceChainSCMgmtActivationAction.sol checks that the newEmergencySecurityCouncil has a upgradeExecutor role whereas the prevEmergencySecurityCouncil does not have a upgradeExecutor role. GovernanceChainSCMgmtActivationAction.sol // confirm...

LendingLedger.sol sends ETH instead of CANTO

Lines of code Vulnerability details Impact In the documentations for the contest it is clearly stated that LendingLedger contract is expected to send CANTO to the user when they call the claim function but in reality it transfers ETH. This could be problematic if the user is a contract that expec...

_scheduleUpdate() should be called during initialize ing the SecurityCouncilManager

Lines of code Vulnerability details Impact Updates will not be scheduled through timelocks and target upgrade executors by the scheduleUpdate call. Initial set of cohort members will not be scheduled. Proof of Concept In SecurityCouncilManager whenever a new member is added, or removed or swapped...

the claim function may underFlow when it calculate the claimEnd

Lines of code Vulnerability details Impact in the claim function there is possibility of the underflow which lead the transaction to revert, the function may underflow in this line uint256 claimEnd = Math.mincurrEpoch - WEEK, claimUpToTimestamp because the currEpoch will return the current epoch...

Misaligned Epoch Calculation for Reward Claims

Lines of code Vulnerability details Impact When users attempt to claim rewards, the contract calculates the claimEnd and subsequently updates the userClaimedEpoch using claimEnd + WEEK. This might result in misaligned epochs in scenarios where claimUpToTimestamp is less than or more than a week. ...

Delegated Votes Blocking Delegator Undelegation

Lines of code Vulnerability details Impact Once a delegator has delegated their votes to a delegatee, and the delegatee employs those votes in an ongoing proposal, the delegator loses the ability to undelegate their votes. VotingEscrow::delegate is used to delegate user A's votes to User B. Once...

Consider Disabling Inherited _cancel Function In The Governor Contracts

Lines of code Vulnerability details Impact The currently used openzeppelin upgradeable contracts dependency @openzeppelin/contracts-upgradeable is v4.7.3 The security council management contracts are inheriting the openzeppelin GovernorUpgradeable contracts to manage proposals. This version of...

_removeMemberFromCohortArray FUNCTION REDUCES THE cohort ARRAY LENGTH BY ONE THUS DoS THE addMember FUNCTIONALITY

Lines of code Vulnerability details Impact The SecurityCouncilManager.removeMemberFromCohortArray function is used to remove a member from a specific cohort. The function will replace the removing member with the last element of the cohort array and will pop the last element of the array as shown...

check for the reentrancy attack is missed in the claim function

Lines of code Vulnerability details Impact the function claim in the LendingLedger.sol will send native token $CANTO to the msg.sender by .call which it can be EOA or Contracts, because there is no any RA checks the caller can make double call in the same time to get himself more tokens reward th...

Lock owner DOS and funds stuck

Lines of code Vulnerability details Impact The lock's owner will no longer have the ability to use the delegate function. Meaning the person he chose to delegate can withdraw his funds when lock expires, but won't be able to. Proof of Concept Lets imagine 3 users with a Lock each: If user 1...

TEST FINDING

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assessed...

vulnerability due to the nonce rolling over and generating duplicate salts

Lines of code Vulnerability details Impact An attacker could take the transaction data from the original proposal and re-submit it to the L2 timelock with the same salt. This would get executed again since the salt matches, allowing the attacker to replay the state change. Proof of Concept The...

User don't have to deposit for a week into the market to get his weekly reward from the LendingLedger

Lines of code Vulnerability details Impact In the LendingLedger contract, a user is rewarded with CANTO tokens depending on how long he has his deposit in the market. Rewards are distributed for each week during which the deposit was inside the market. However, the user can cheat this condition...

USN-6237-2: curl regression | Cloud Foundry

Severity Unknown Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description USN-6237-1 fixed vulnerabilities in curl. The update caused a certificate wildcard handling regression on Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original...

Delegate system can be used to increase voting power without resetting the lockEnd

Lines of code Vulnerability details Impact The added delegate mechanism allows increasing the voting power without resetting the lockEnd. Proof of Concept IncreaseAmount increases the locked amount of a msg.sender staked native in VotingEscrow and resets its lockEnd to block.timestamp + LOCKTIME...