NFT is not burned during unlock

Handle sirhashalot Vulnerability details Impact When the lock function is called, an ERC721 token is minted. The unlock function should perform the opposite operation as lock and burn the corresponding NFT. The unlock function modifies the positionOf mapping, but does NOT call the burn function t...

NFT token id repeated

Handle MaCree Vulnerability details Impact 1. merge funtion may lead to create repeated NFT token id, so user can not lock XDEFI Proof of Concept run the test case below please beforeEachasync = god, account1, account2, account3 = await ethers.getSigners; XDEFI = await await await...

Missing burn function in _unlock function

Handle Tomio Vulnerability details Impact In the XDEFIDistribution.sol, a user can lock xdefi token and get an erc721/nft token through safeMint function, however when the user call unlock function this contract will delete the position of this user, but didnt call the burn function in ERC721...

merge is loss of all assets

Handle danb Vulnerability details merge function mints nft, but doesn't add it to positionOf, which makes it worthless, in addition it burns all the nfts of the user which means they lost all assets. --- The text was updated successfully, but these errors were encountered: All reactions...

DOS - preventing users from locking assets

Handle egjlmn1 Vulnerability details An attacker can prevent any user from locking assets due to the unsafe id generation for the nfts. The id is generated by using only the amount deposited, the duration to lock and the totalSiupply of nfts. The first two are easy for the attacker to copy, so al...

Customer support scammers take aim at NFT enthusiasts

Adidas has been making waves in the NFT space with a collection of footwear/bored ape crossover sales. WEN? EARLY ACCESS MINTING STARTS NOW First look of the collaborative NFT with @gmoneyNFT @punkscomic and @BoredApeYC Good luck and TracksuitUp pic.twitter.com/REYOSdRbNT -- adidas Originals...

PT-2021-8133 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The vulnerability is related to a use-after-free issue in the netfilter component of the Linux kernel. This issue can be exploited to potentially elevate privileges in the system. The...

Unable to Unlock NFT Once it Locked and Owner may Lose His Token Permanently

Handle Meta0xNull Vulnerability details Impact function lockNft Allow Owner of NFT Lock his NFT. But Once it Locked, there is No UnLock Function and thus Owner may lose his token permanently because it is Required to be Unlock in beforeTokenTransfer. Proof of Concept Tools Used Manual Review...

Crypto Hackers Using Babadeda Crypter to Make Their Malware Undetectable

A new malware campaign has been discovered targeting cryptocurrency, non-fungible token NFT, and DeFi aficionados through Discord channels to deploy a crypter named "Babadeda" that's capable of bypassing antivirus solutions and stage a variety of attacks. "This malware installer has been used in ...

keyPrice is global and change on keyPrice can damage lockManager or keyOwner

Handle 0x0x0x Vulnerability details Impact A lock manager changes keyPrice. If the price is increased, then possible refunds are also increased and it can result in theft of funds. If the price is reduced, by doing so lock manager can reduce the refund payments and scam the users. Tools Used Manu...

123SWAP: A platform to mint and trade NFTs

By Waqas 123swap is a decentralized trans-chain network with the vision to bridge both the gap between DEX and CEX and between smart contracts across various chains. This is a post from HackRead.com Read the original post: 123SWAP: A platform to mint and trade NFTs...

Vested NFT not always minted

Handle cmichel Vulnerability details The FSDVesting.claimVestedTokens function tokenizes the conviction only if the current claimed amount tokenClaim equals the total vested amount amount. // tokenClaim is vestedAmount - totalClaimed uint256 tokenClaim = calculateVestingClaim; if amount ==...

ERC20ConvictionScore._writeCheckpoint` does not write to storage on same block

Handle cmichel Vulnerability details In ERC20ConvictionScore.writeCheckpoint, when the checkpoint is overwritten checkpoint.fromBlock == blockNumber, the new value is set to the memory checkpoint structure and never written to storage. // @audit this is MEMORY, setting new convictionScore doesn't...

Beneficiary cant get fairSideConviction NFT unless they only claim once, and only after it's fully vested

Handle WatchPug Vulnerability details Based on the context, once the beneficiary claimed all their vesting tokens, they should get the fairSideConviction NFT. However, in the current implementation, if the beneficiary has claimed any amounts before it's fully vested, then they will never be able ...

NFT flashloans can bypass sale constraints

Handle pauliax Vulnerability details Impact Public sale has a constraint that for the first 4 weeks only NFT holders can access the sale: if currentEra firstPublicEra requirenft.balanceOfmsg.sender 0, "You need NFT to participate in the sale."; However, this check can be easily bypassed with the...

iptables bug fix and enhancement update

The iptables utility controls the network packet filtering code in the Linux kernel. Bug Fixes and Enhancements: iptables-nft returns incorrect result for -C when concurrently running BZ1990016...

Changing NFT contract in the MochiEngine would break the protocol

Handle jonah1005 Vulnerability details Impact MochiEngine allows the operator to change the NFT contract. MochiEngine.solL91-L93 All the vaults would point to a different NFT address. As a result, users would not be access their positions. The entire protocol would be broken. IMHO, A function tha...

Critical Flaw in OpenSea Could Have Let Hackers Steal Cryptocurrency From Wallets

A now-patched critical vulnerability in OpenSea, the world's largest non-fungible token NFT marketplace, could've been abused by malicious actors to drain cryptocurrency funds from a victim by sending a specially-crafted token, opening a new attack vector for exploitation. The findings come from...

NFT Collector Tricked into Buying Fake Banksy

An attacker was apparently able to breach the site for famed street artist Banksy and sell a fake non-fungible token NFT of the artist’s work for more than $336,000. The fraudster has since returned the ill-gotten cash, less a “transaction fee.” But the incident has delivered an invaluable lesson...

Official website of Banksy hacked for fake NFT scam

By Deeba Ahmed British Art Collector Buys Fake Banksy NFT for £244k, Scammer Returned Funds Later. Here's What Happened and How the Funds were Returned. This is a post from HackRead.com Read the original post: Official website of Banksy hacked for fake NFT scam...