Incorrect Calculation

OpenZeppelin Contracts is vulnerable to Incorrect Calculations. The vulnerability exists in the beforeTokenTransfer function because ERC721Consecutive does not update balances when the batch has a size of one and consists of a single token, resulting in a token overflow when calling the balanceOf...

MerkleMinter created through TokenFactory cannot be upgraded

Lines of code Vulnerability details Impact During the token creation process in the TokenFactory contract, the function creates a MerkleMinter contract to setup and handle token initial token distribution. ... // Clone and initialize a MerkleMinter address merkleMinter = merkleMinterBase.clone;...

ActivePool.sol – Re-entrancy risk on _rebalance function

Lines of code Vulnerability details The rebalance function is vulnerable to a reentrancy attack. Specifically, an external callee can take over the control flow of the function by calling back into the ActivePool contract via a method that triggers the rebalance function again before it completes...

Integer Overflow & Underflow

Lines of code Vulnerability details Impact In the setYieldDistributionParams function, there is a danger of underflow or overflow of functionality. Owner calls the function and sets the values to be passed as uint256 for treasurySplit, SPSplit & stakingSplit. There is no check in place to ensure...

CVE-2023-26488

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

Buffer overflow

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

CVE-2023-26488 OpenZeppelin Contracts contains Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

CVE-2023-26488 OpenZeppelin Contracts contains Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

CVE-2023-26488 OpenZeppelin Contracts contains Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

CVE-2023-26488

OpenZeppelin Contracts ERC721Consecutive has a balance-update bug for batches of size 1, causing balanceOf to overflow. Root cause: balances not updated after mint/batch transfers. Impact is partial (balance overflow risk) and fixes were applied in version 4.8.2; update to 4.8.2 or later to remed...

OpenZeppelin Contracts contains Incorrect Calculation

Impact The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by balanceOf. The issue exclusively presents with...

@1inch/delegating (>=0.0.8, <=0.0.21), @1inch/erc20-pods (>=0.0.8, <=0.0.17) +67 more potentially affected by CVE-2023-26488 via @openzeppelin/contracts (>=4.8.0, <=4.8.1)

@openzeppelin/contracts NPM version =4.8.0, =0.0.8, =0.0.8, =1.1.2, =0.0.1, =2.0.0, =0.7.0-alpha, =1.2.0, =0.0.1, =1.0.4, =1.0.1, =1.0.15, =2.0.2 and more Source cves: CVE-2023-26488 Source advisory: OSV:GHSA-878M-3G6Q-594Q...

@aragon/core-contracts (>=0.7.0-alpha, <=0.8.0-alpha), @aragon/osx (>=1.2.0, <=1.3.0) +41 more potentially affected by CVE-2023-26488 via @openzeppelin/contracts-upgradeable (>=4.8.0, <=4.8.1)

@openzeppelin/contracts-upgradeable NPM version =4.8.0, =0.7.0-alpha, =1.2.0, =0.0.1, =0.0.1, =1.0.4, =2.0.0, =1.0.1, =1.0.15, =1.0.27, =1.0.16, =1.0.0, =2.0.2 and more Source cves: CVE-2023-26488 Source advisory: OSV:GHSA-878M-3G6Q-594Q...

Upgraded Q -> 2 from #633 [1677880427560]

Judge has assessed an item in Issue 633 as 2 risk. The relevant finding follows: Vault contract implementation does not disable initializers The Vault.sol contract should implement disableInitializers in its constructure to prevent implementation contracts from being initialized. As this contract...

PT-2023-20679 · Openzeppelin · Openzeppelin Contracts

Name of the Vulnerable Software and Affected Versions: OpenZeppelin Contracts versions prior to 4.8.2 Description: The ERC721Consecutive contract, designed for minting NFTs in batches, does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts that stems from an amount overflowing during transmission...

CVE-2023-26488: Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

Unsafe token transfer in MultiRewardStaking and VaultController contracts

Lines of code Vulnerability details Impact The vulnerability in the MultiRewardStaking and VaultController contracts lies in the usage of the transfer and transferFrom functions, which does not provide the safety checks for the transfer of tokens, especially since the reward token can have...

CVE-2023-23940

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. isvalidethsignature is missing a call to finalizekeccak after calling verifyethsignature. As a result, any contract using isvalidethsignature from the...

Input validation

OpenZeppelin Contracts for Cairo is a library for secure smart contract development written in Cairo for StarkNet, a decentralized ZK Rollup. isvalidethsignature is missing a call to finalizekeccak after calling verifyethsignature. As a result, any contract using isvalidethsignature from the...