approve() can be front-run

Lines of code Vulnerability details Impact In MToken.sol we have approve function: function approveaddress spender, uint256 amount override external returns bool address src = msg.sender; transferAllowancessrcspender = amount; emit Approvalsrc, spender, amount; ...

Users repay more than the approved amount.

Lines of code Vulnerability details Impact More tokens can be repaid than were approved leading to loss of funds Proof of Concept The repayBorrowFresh function does the following: 1. Checks if repay is allowed by calling comptroller.repayBorrowAllowed with the input repayAmount. 2. Fetches the...

Migration of Profiles can fail due to existance of same handle

Lines of code Vulnerability details Impact Some profiles cannot be migrated to V2 if their handle tokenId has already been minted. Proof of Concept A handle can be minted in the LensHandles contract before a profile that would have the same handle is migrated from V1. When the profile attempts to...

liquidateBorrow() mTokens that do not enter the market can still be liquidated as collateral

Lines of code Vulnerability details Impact borrower's mTokens that do not join the market, but it still be Liquidation as collateral Proof of Concept If user wants to use mToken as collateral, the user needs to enter market with enterMarket function. / @notice Add assets to be included in account...

No Receive functiion in TemporalGovernor contract

Lines of code Vulnerability details Impact The function executeProposal in TemporalGovernor contract will fail, if there is a value to send with the call to the targets executeProposal function could send native token out along with a call to the targets encoded in vm.payload, but the current...

In LensBaseERC721.sol#_transfer() Lack of check from==to

Lines of code Vulnerability details Impact In LensBaseERC721.soltransfer balances of from and to are stored in temporary variables and after the subtration, addition operation the results are written to storage. In the second operation since the original balance is used in the addition operation,...

safe32 WILL RESTRICT THE DURATION OF MultiRewardDistributor._addEmissionConfig FUNCTION USABILITY

Lines of code Vulnerability details Impact The MultiRewardDistributor.addEmissionConfig function is used to add a new emission configuration for a specific market. The addEmissionConfig function constructs the MarketConfig configuration struct using the input parameters to the function. The...

the unbounded approve function allows a front-running vulnerability due to setting unlimited allowance.

Lines of code Vulnerability details Impact if approve is called with a very high allowance, the spender can drain the owner's entire balance. Proof of Concept approve allows setting an allowance to any arbitrary uint256 value, including typeuint.max. This effectively gives unlimited approval to t...

CVE-2023-4004

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nftpipaporemove function with the element, without a NFTSETEXTKEYEND. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. Mitigation This flaw...

Missing owner check on from when transferring tokens

Lines of code Vulnerability details Impact The LensBaseERC721.transferFrom/safeTransferFrom/burn they check approvals on msg.sender through isApprovedOrOwnermsg.sender, tokenId, it is never checked that the specified from parameter is actually the owner of the NFT. An attacker can decrease other...

wrap after unfollow is enabled

Lines of code Vulnerability details Impact wrap after unfollownft is enabled , cause many problems Proof of Concept by design, wrap after unfollowed is not allowed,but it seems that it's possible due to lack of limitation. poc below: add below script in FollowNFTTest.t.sol //forge test --match-te...

CVE-2023-36542

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission fo...

CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission fo...

CVE-2023-36542

Summary of CVE-2023-36542 (Apache NiFi) : NiFi versions 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which can enable a privileged user to configure a location that allows custom code execution. The root cause involves re...

Unchecked Call Return Value of ERC20 Functions

Lines of code Vulnerability details Impact The return value of 'transfer' and 'transferFrom' should be verified since these two functions may only return false but not cause execution reverted once fail. If not properly handled, it might incur asset losses to users and the project party. Tools Us...

tryMigrate() has onlyHub modifier but it's called from LensV2Migration

Lines of code Vulnerability details Impact In FollowNFT.sol, tryMigrate function has onlyHub modifier as other functions that are supposed to be called by LensHub such as follow and unfollow. These functions are called via delegatecall and LensHub is preserved as msg.sender. The problem is that t...

Exploit for Command Injection in Tp-Link Archer_Ax21_Firmware

Description CVE-2023–1389 is an Unauthenticated Command Inject...

a user can not change there vote and will cause to revert when trying due to uninitialized enum

Lines of code Vulnerability details Impact in CoreVoting.vote if you are voting again or changing direction firstly it will subtract the previous vote amount of votes but when doing that it is using uninitialized enum castBallot which by default return 0 yes enum to subtract from if...

_getSelector does not return the right selector

Lines of code Vulnerability details Impact getSelector... function in the CoreVoting.sol will NEVER return the correct function selector of a calldata string. This can lead to malfunction in the system when creating a proposal. Proof of Concept The function selector is suppose to be the hash dige...

NFTBoostVault is not a proper implementation/logic contract in upgradeability system

Lines of code Vulnerability details Impact As per the natspec comments in the NFTBoostVault contract, the NFTBoostVault contract "is Simple Proxy upgradeable which is the upgradeability system used for voting vaults in Council". This implies that this contract will be used as the...