PT-2023-4293

Name of the Vulnerable Software and Affected Versions ASP.NET affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in ASP.NET, which allows attackers to affect the system. This vulnerability is associated with insufficient access controls in...

Lack of authentication in rngComplete

Lines of code Vulnerability details Impact In RngRelayAuction.sol the rngComplete function is meant to be called only by the rngAuctionRelayer contract, however, it can currently be called by any user. Consequently any random number can be used to close a prize pool draw, benefiting the malicious...

function rngComplete is unpprotected

Lines of code Vulnerability details Impact The rngComplete is a function Called by the relayer to complete the Rng relay auction. However it has zero access control. Proof of Concept The function makes calls to the prizepool to close a draw, it also withdraws from a reserve. All these are done wi...

Inflation attacks with virtual shares and assets on GeVault

Lines of code Vulnerability details Impact An inflation attacks can be done on the first deposit into the GeVault contract. Making the first real depositor losing his deposit. Proof of Concept Inflation attack steps : First, Alice the attacker need to craft a deposit that put valueX8 = 1 = Thus...

rate is wrong

Lines of code Vulnerability details Impact attacker can manipulate pool price to make strategy have eth lower as it should have 1 seth 1 eth then mint new steth 1 steth = 1 eth so attacker can gain share more than normal Proof of Concept 1. attacker manipulate pool price 1 seth 1 eth 2. attacker...

manipulate rate

Lines of code Vulnerability details Impact using spot price as the exchange rate can be manipulated. Proof of Concept 1. attacker manipulates the balancer pool making eth very expensive 2. By calling the updateCache function, the attacker updates the cachedCalculatedAmount based on the manipulate...

bboss 代码注入漏洞

bboss is a J2EE framework in the bboss open source. A security vulnerability exists in bboss bboss-persistent v6.0.9 and earlier versions, which stems from a code injection vulnerability in the component com.frameworkset.common.poolman.util.SQLManager.createPool...

DEBIAN-CVE-2023-3750

A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to...

CVE-2023-3750

A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to...

CVE-2023-3750 Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service

A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to...

SUSE CVE-2023-3750

A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to...

UBUNTU-CVE-2023-3750

A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to...

PT-2023-8982 · Libvirt +6 · Libvirt +6

Name of the Vulnerable Software and Affected Versions: libvirt affected versions not specified Description: A flaw was found in the virStoragePoolObjListSearch function of libvirt, which does not return a locked pool as expected. This results in a race condition and denial of service when...

Upgraded Q -> 2 from #422 [1689707351452]

Judge has assessed an item in Issue 422 as 2 risk. The relevant finding follows: 01 In the function PrizePool.setDrawManager, anyone can frontrun it and become the drawManager Reading the documentation of the Prize Pool contract, the following is specified: The Prize Pool allows a 'draw manager'...

Red Hat libvirt 安全漏洞

Red Hat libvirt is a Linux API for implementing Linux virtualization features from Red Hat, Inc. that supports a variety of Hypervisors, including Xen and KVM, as well as QEMU and a number of virtual products for other operating systems. A security vulnerability exists in Red Hat libvirt that ste...

Permit does not revert for tokens that do not implement it.

Lines of code Vulnerability details Impact Callers should not rely on permit to revert for arbitrary tokens especially if permit is used as a security check. Tokens which do not revert on permit either do not implement it or have a non-reverting fallback function. Most notable among them is WETH...

Possible to stop trading

Lines of code Vulnerability details Impact It's possible to stop market due to division by 0 exception. So better to prevent this, because better to revert with missing minAmountOut than revert with some error, which might be complicated to detect. Proof of Concept There is a change to withdraw a...

Funds added to reserves through sync are accidentally transferred out to users

Lines of code Vulnerability details Impact Wells have the ability to shift funds to other Wells as part of gas-efficient multi-pool swaps. This natspec explanation of this can be find here. The sync function is intended to synchronize the underlying token amounts with the token reserves of the...

The existence of Pump may hinder large swaps or swaps from a low liquidity pool

Lines of code Vulnerability details Impact Large swaps or swaps with low liquidity value may not work properly. Proof of Concept According to the whitepaper, the purpose of the pump is to be a multi-block MEV manipulation resistant to large changes in liquidity value. Since the Well can be create...

There is a large precision error in sqrt calculation of lp

Lines of code Vulnerability details Impact Compared with div, there is a larger precision error in calculating lp through sqrt, so there should be a way to check whether there are excess tokens left when adding liquidity. Proof of Concept function testCalcLpTokenSupplyDiff public uint256 memory...