Lucene search
K

1077 matches found

Code423n4
Code423n4
added 2022/07/14 12:0 a.m.10 views

Small scalar may make buyoutPrice calculation incorrectly

Lines of code Vulnerability details Impact In Buyout.start function, buyoutPrice is calculated using a scalar = 100. This small scalar and division rouding will reduce the precision of the formula significantly. Proof of Concept 1. Alice call start with msg.value = 1e18 and depositAmount = 4567...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/07/14 12:0 a.m.9 views

fractionPrice precision can be lost if fractional tokens supply is high enough

Lines of code Vulnerability details Buyout's start now determine fractional token price by dividing native tokens amount by total supply number. Whenever the supply is high enough the precision can be lost, leading to severe losses to buyout proposer as his staked fractional tokens can be valued ...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/06/26 12:0 a.m.11 views

User fund lose in addLiquidity() of LiquidityReserve by increasing (totalLockedValue / totalSupply()) to very large number by attacker

Lines of code Vulnerability details Impact Function addLiquidity suppose to do add Liquidity for the staking Token and receive lrToken in exchange. to calculate amount of IrToken codes uses this calculation: amountToMint = amount lrFoxSupply / totalLockedValue but it's possible for attacker to...

6.9AI score
Exploits0
Code423n4
Code423n4
added 2022/06/21 12:0 a.m.13 views

zeroswap/UniswapV2Pair.sol Token reserves per lp token can be manipulated due to lack of MINIMUM_LIQUIDITY when minting the first liquidity with migrator

Lines of code Vulnerability details if totalSupply == 0 address migrator = IUniswapV2Factoryfactory.migrator; if msg.sender == migrator liquidity = IMigratormigrator.desiredLiquidity; requireliquidity 0 && liquidity != uint256-1, "Bad desired liquidity"; else requiremigrator == address0, "Must no...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/06/19 12:0 a.m.9 views

Precision Loss During Division

Lines of code Vulnerability details Proof-of-Concept Assume that toSwap = 10 DAI and pathLen = 3 in this example. Therefore, the bridge will pull 10 DAI from the RouterFacet contract. However, within the BridgeFacet.handleExecuteLiquidity function, due to precision loss when solidity handles...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/06/18 12:0 a.m.9 views

User can bypass entryFee by sending arbitrary calldata to ParaSwap operator

Lines of code Vulnerability details Impact Any user is able to bypass the entryFee collection when using NestedFactory.create by passing in arbitrary calldata when using the ParaSwap router. High level, a user can pass in calldata to swap from a miniscule amount of input token to an ERC777 with...

7.3AI score
Exploits0
Microsoft CVE
Microsoft CVE
added 2022/06/17 7:0 a.m.5 views

Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a large precision value in an integer format string specifier to the format function as demonstrated via a certain "emacs -batch -eval" command line.

...

10CVSS7AI score0.02987EPSS
Exploits0
vulnersOsv
vulnersOsv
added 2022/06/16 11:41 p.m.2 views

abd-clam (>=0.10.0-dev0 <=0.12.1), adbc_core (=0.14.0) +286 more potentially affected by unknown CVE via arrow (>=0.16.0 <=5.5.0)

arrow CARGO version =0.16.0, =0.10.0-dev0, =0.6.0, =0.6.0, =0.2.0, =0.4.0, =0.3.0, =0.2.0, =2.0.0, =0.2.0, =0.1.0, =0.2.0 - arrow-graph-core =0.1.0 - arrow-graph-git =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-H588-76VG-PRGJ...

5.5AI score
Exploits0
Code423n4
Code423n4
added 2022/06/14 12:0 a.m.17 views

Division round down 2 times may cause convertToShares calculation incorrect if underlying token with decimals less than 8.

Lines of code Vulnerability details Impact In case fCash has not matured yet, convertToShares may return incorrect value due to division round down 2 times. It may leads to the case that user need more amount of share than expected to withdraw assets. In wfCashERC4626.convertToShares function, it...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/06/02 12:0 a.m.8 views

attacker or user can take advantage of percsion error and effect staking

Lines of code Vulnerability details uint256 unlockAt = block.timestamp + maxTime; unlock uninweeks can have precision issues because no floating point variables in solidity so if unlockat is 10.32 is 10 /week 3 it will 3 3 =9 instead of almost 4 weeks so users can unlock before the time they...

6.8AI score
Exploits0
Redos
Redos
added 2022/06/01 12:0 a.m.37 views

ROS-20220131-01

Vulnerability in the ptp4l service of the LinuxPTP precision time protocol PTP implementation software is caused by an operation exceeding buffer boundaries in memory. Exploitation of the vulnerability could allow an attacker, acting remotely, cause the application to crash as a result of creatin...

8.8CVSS8.2AI score0.02955EPSS
Exploits0
Code423n4
Code423n4
added 2022/05/28 12:0 a.m.14 views

BathToken with initial liquidity of 1 wei causes very expensive share price leading to precision errors and loss of funds

Lines of code Vulnerability details Impact The creator of a new BathToken is able to maliciously manipulate the share price by providing lowest possible amount 1 wei of liquidity initialLiquidityNew and then artificially blowing up the BathToken token balance. Following depositors will loose thei...

6.8AI score
Exploits0
Malwarebytes
Malwarebytes
added 2022/05/17 2:12 p.m.31 views

AirTag stalking: What is it, and how can I avoid it?

More voices are being raised against the use of everyday technology repurposed to attack and stalk people. Most recently, its reported that Ohio has proposed a new bill in relation to electronic tagging devices. The bill, aimed at making short work of a loophole allowing people with no stalking o...

0.1AI score
Exploits0
Github Security Blog
Github Security Blog
added 2022/05/17 4:31 a.m.25 views

OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events

The MySQL token driver in OpenStack Identity Keystone 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token...

4.9CVSS6.8AI score0.01592EPSS
Exploits0References10Affected Software1
OSV
OSV
added 2022/05/14 2:16 a.m.30 views

GHSA-GVGC-RXMH-5HVW Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment

The Double.parseDouble method in Java Runtime Environment JRE in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.229 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a...

5CVSS8.5AI score0.2349EPSS
Exploits1References60
Code423n4
Code423n4
added 2022/05/14 12:0 a.m.10 views

Strike price curve of getDutchAuctionStrike is not what users expect

Lines of code Vulnerability details Note: This submission contains links to a private fork of the contest repo. User code423n4 has been added as a collaborator in order to view. Impact Function getDutchAuctionStrike does not implement the function that Option buyers would expect. They probably...

6.8AI score
Exploits0
Code423n4
Code423n4
added 2022/05/01 12:0 a.m.11 views

[WP-H1] A malicious early user/attacker can manipulate the vault's pricePerShare to take an unfair share of future users' deposits

Lines of code Vulnerability details This is a well-known attack vector for new contracts that utilize pricePerShare for accounting. / @notice Calculates the number of shares that should be minted or burnt when a user deposit or withdraw. @param tokens Amount of asset tokens @return Number of...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/04/30 12:0 a.m.10 views

User fund loss in supplyTokenTo() because of rounding

Lines of code Vulnerability details Impact When user use supplyTokenTo to deposit his tokens and get share in FeildSource because of rounding in division user gets lower amount of share. for example if token's decimal was 1 and totalSupply was 1000 and aToken.balanceOfFieldSource.address was 2100...

7AI score
Exploits0
Code423n4
Code423n4
added 2022/04/29 12:0 a.m.7 views

Lack of require in redeemToken could produce token loses

Lines of code Vulnerability details Impact Lack of require in redeemToken could produce token loses. Proof of Concept In the method redeemToken the user set the expected redeemAmount, it will compute the expected shares to burn, and after it, it will transfer the amout according the redeemAmount...

6.7AI score
Exploits0
Code423n4
Code423n4
added 2022/04/27 12:0 a.m.16 views

First xERC4626 deposit exploit can break share calculation

Lines of code Vulnerability details Solmate convertToShares function follow the formula: assetDepositAmount totalShareSupply / assetBalanceBeforeDeposit. The share price always return 1:1 with asset token. If everything work normally, share price will slowly increase with time to 1:2 or 1:10 as...

6.9AI score
Exploits0
Rows per page
Query Builder