Miscalculation of OLAS Amount Due to Inaccurate LP Token Price in Specific Bonding Mechanism Scenarios

Lines of code Vulnerability details Impact Incorrect valuation of the LP Token price can result in either an excess issuance of OLAS Tokens, causing a loss to the protocol, or a lower issuance of OLAS Tokens, leading to losses for the user. Proof of Concept The prototype of the create function in...

Prime.sol currently miscalculates the duration users have already staked, which breaks multiple core functions.

Lines of code Vulnerability details Summary A wrong assumption is currently being made regarding the time taken to mine a block in all chains where the protocol will be deployed this is cause multiple core functions inappropriately equate block per year to seconds per year. Impact The impact is...

Re-org attack in factory LiquidationPairFactory.sol

Lines of code Vulnerability details Impact Allowing creation of new LiquidationPairs by Re-org attack may adversely affect pricing in LiquidationPair.sol contracts. Proof of Concept The LiquidationPairFactory.solcreatePair function deploys a new LiquidationPair using the create, where the address...

A reorg on the origin chain after a proposal has been validated will result in loss of funds for the protocol

Lines of code Vulnerability details Impact The protocol will lose the funds that the user sent to the origin chain InterchainProposalSender contract for the proposal. Proof of Concept When a proposal gets submitted it gets reviewed by validators on the Axelar network and then receives a validatio...

Many create methods are suspicious of the reorg attack

Lines of code Vulnerability details Proof of Concept There are many instance of this, but to understand things better, taking the example of createTalosV3Strategy method. The createTalosV3Strategy function deploys a new TalosStrategyStaked contract using the create, where the address derivation...

Atomic Wallet Hit by $35M Theft in Recent Crypto Breach

By Habiba Rashid The stolen tokens include popular cryptocurrencies such as Bitcoin BTC, ether ETH, tether USDT, dogecoin DOGE, Litecoin LTC, BNB coin BNB, and polygon MATIC. This is a post from HackRead.com Read the original post: Atomic Wallet Hit by $35M Theft in Recent Crypto Breach...

GLSA-202305-34 : CGAL: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202305-34 CGAL: Multiple Vulnerabilities - A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef2/PMioparser.h PMioparser::readvertex...

@0xagnish/circom2-create-project (1.0.412), @0xagnish/create-circom2-project (>=1.0.0, <=1.0.418) +329 more potentially affected by CVE-2023-33252 via snarkjs (>=0.1.7, <=0.6.11)

snarkjs NPM version =0.1.7, =1.0.0, =1.0.0, =1.0.0-beta.0, =1.0.0, =1.1.1, =2.0.0-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.1, =0.0.1, =0.0.1, =0.1.0, =0.2.2 and more Source cves: CVE-2023-33252 Source advisory: OSV:GHSA-XP5G-JHG3-3RG2...

PT-2023-35787 · Git +1 · Libheif

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is identified, potentially causing a crash. The crash occurs in the RegionGeometry Polygon::parse function, which is...

createNewPosition/clonePosition/createClone are suspicious of the reorg attack

Lines of code Vulnerability details Description The createNewPosition function creates a new position smart contract and returns its address. The address is determined by create address derivation, that depends on the contract nonce. Later user could use interact with newly created contract. At t...

SUSE CVE-2014-1508

The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process memory, cause a denial of service out-of-bounds read and application...

SUSE CVE-2016-4562

The DrawDashPolygon function in MagickCore/draw.c in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 mishandles calculations of certain vertices integer data, which allows remote attackers to cause a denial of service buffer overflow and application crash or possibly have unspecified other impa...

SUSE CVE-2017-7870

LibreOffice before 2017-01-02 has an out-of-bounds write caused by a heap-based buffer overflow related to the tools::Polygon::Insert function in tools/source/generic/poly.cxx...

SUSE CVE-2020-28601

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef2/PMioparser.h PMioparser::readvertex Faceof OOB read. An attacker can provide malicious input to trigger this vulnerability...

SUSE CVE-2020-28636

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in NefS2/SNCioparser.h SNCioparser::readsloop slh-twin An attacker can provide malicious input to trigger this vulnerability...

SUSE CVE-2020-35628

A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in NefS2/SNCioparser.h SNCioparser::readsloop slh-incidentsface. An attacker can provide malicious input to trigger this vulnerability...

PT-2023-1400 · Microsoft · 3Dprint

Name of the Vulnerable Software and Affected Versions: Print 3D affected versions not specified Description: The issue is related to insufficient input validation in the Print 3D program, which can be exploited by an attacker to execute arbitrary code using a specially crafted file. This can lead...

QuestFactory is suspicious of the reorg attack

Lines of code Vulnerability details Description The createQuest function deploys a quest contract using the create, where the address derivation depends only on the QuestFactory nonce. At the same time, some of the chains Polygon, Optimism, Arbitrum to which the QuestFactory will be deployed are...

[SECURITY] [DLA 3226-1] cgal security update

Debian LTS Advisory DLA-3226-1 [email protected] https://www.debian.org/lts/security/ Helmut Grohne December 06, 2022 https://wiki.debian.org/LTS Package : cgal Version : 4.13-1+deb10u1 CVE ID : CVE-2020-28601 CVE-2020-28602 CVE-2020-28603 CVE-2020-28604 CVE-2020-28605 CVE-2020-28606...

Debian dla-3226 : libcgal-demo - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3226 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3226-1 [email protected]...