Front-Running Vulnerability: Exploiting Reward Updates for Maximized Payouts

Lines of code Vulnerability details Impact Malicious users claim rewards at a higher rate than what was intended by front-running governance actions meant to reduce rewards. This allows them to claim rewards at a higher rate than what was intended, undermining the protocol's intended economic...

Ransomware review: August 2023

This article is based on research by Marcelo Rivero, Malwarebytes' ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, "known attacks" are those where the victim did not pay a ransom. This provides the best overall picture of...

Ransomware making big money through "big game hunting"

Ransomware generates big money for the groups behind it, with new research confirming some of the scale of the problem. Chainalysis, a blockchain research firm, looked at data from monitored cryptocurrency wallets, concluding that around $449 million has been taken from victims in the last six...

Malicious code in payouts-sdk-samples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3db91ea244189b9afd98f67f2aa7ce4dd00812c2ab83bba670a7f9d285cf167 The OpenSSF Package Analysis project identified 'payouts-sdk-samples' @ 99.20.20 npm as malicious. It is considered malicious because: - The...

Inside Qilin Ransomware: Affiliates Take Home 85% of Ransom Payouts

Ransomware affiliates associated with the Qilin ransomware-as-a-service RaaS scheme earn anywhere between 80% to 85% of each ransom payment, according to new findings from Group-IB. The cybersecurity firm said it was able to infiltrate the group in March 2023, uncovering details about the...

Estimated profit may drift

Lines of code Vulnerability details Impact The lottery is not sustainable over time. Excess pot calculation may drift, which either leads to insufficient payouts or a depletion of funds. Proof of Concept The payouts are calculated using an estimate of the net profit, currentNetProfit. There is...

Truncate of values can be avoided

Lines of code Vulnerability details Truncate of values can be avoided Summary Solidity integer division might truncate. As a result, performing multiplication before division can sometimes avoid loss of precision. Details In general, this is a problem due to precision. In this case, it also affec...

Minimum balance requirement for payout

Lines of code Vulnerability details Impact Payouts from PA1D.sol cannot be made unless the balance is sufficiently high, meaning Proof of Concept In PA1D.sol the payout functions payoutEth, payoutToken and payoutTokens require that balance 10000. If this is not met the recipients cannot receive...

Number of prizes math is wrong

Handle cmichel Vulnerability details The math described in Splitting the prizes and implemented in DrawCalculator.numberOfPrizesForIndex seems to be wrong. Assuming a bit range of 4 16 possibilities per position and cardinality of 8. Note that degree is determined by the first position where it...

A Devastating Twitch Hack Sends Streamers Reeling

The data breach apparently includes source code, gamer payouts, and more...

Acronis Offers up to $5,000 to users who spot bugs in its cyber protection products

Acronis, the Swiss-Singaporean cyber protection company, has recently opened its long-standing bug bounty program to the public at large – now able to process twice as many reports. Users who discover vulnerabilities in Acronis’ software can earn up to $5,000, as well as additional perks. Through...

Card affiliate payouts are skipped if a single card does not have an affiliate

Handle cmichel Vulnerability details Vulnerability Details The Market.initialize function sets the cardAffiliateCut to zero if a single cardAffiliateAddresses is the zero address. for uint256 i = 0; i numberOfCards; i++ if cardAffiliateAddressesi == address0 cardAffiliateCut = 0; Impact Even if a...

Google Sets Record High in Bug-Bounty Payouts

Google paid out $6.5 million in bug-bounty rewards in 2019, which doubles the internet behemoth’s previous annual top total. It has also highlighted additional bonuses that are now in effect for Chrome and Android. Last year saw some notable changes for Google’s Vulnerability Reward Programs VRPs...

Mozilla Bug Bounty Program Doubles Payouts, Adds Firefox Monitor

Mozilla is bumping up its bug bounty payouts and has added new websites and services – including the recently deployed Firefox Monitor– to its bug bounty program in hopes of attracting more researchers to sniff out vulnerabilities. The browser-maker is doubling bug bounty payouts for most of its...

The Brave Browser Extends Its Payouts to iOS

Nearly four years after Brave proposed paying users to surf the web, that vision is finally coming to the iPhone...

Exploit Reseller Offering Up To $2.5 Million For Android Zero-Days

Well, there's some good news for hackers and vulnerability hunters, though terrible news for Google, Android device manufacturers, and their billions of users worldwide. The zero-day buying and selling industry has recently taken a shift towards Android operating system, offering up to $2.5 milli...

Google Triples Some Bug Bounty Payouts

Google is upping the ante for its Chrome bug bounty rewards program, doubling payouts from $15,000 to $30,000 for “high-quality” reports. It is also tripling baseline payouts for Chrome to $15,000. The bug-bounty pay raise is part of Google’s Chromium open-source project, which supplies the vast...

Zerodium Offers to Buy Zero-Day Exploits at Higher Prices Than Ever

Well, there's some good news for hackers and vulnerability hunters, though terrible news for tech manufacturers! Exploit vendor Zerodium is now willing to offer significantly higher payouts for full, working zero-day exploits that allow stealing of data from WhatsApp, iMessage and other online ch...

Zerodium Raises Zero-Day Payout Ceiling to $2M

Exploit acquisition vendor Zerodium said Monday that it is upping its payouts for full, working exploits across its entire program. It’s now paying $2 million for remote iOS jailbreaks, $1 million for WhatsApp/iMessage/SMS/MMS remote code-execution RCE and a half-million for Google Chrome RCEs. T...

Bug Bounty: Earn $40,000 for hacking Facebook, Instagram or WhatsApp

By Waqas Facebook has launched a new bug bounty program inviting hackers to identify and report vulnerabilities in its website and applications. The social network has increased payouts and offers researchers to look for vulnerabilities in a wide variety of products owned by Facebook including...