CVE-2020-21503

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free...

Time window must be chosen carefully

Handle tensors Vulnerability details Impact The variable timeWindow in the formula of valuation/README.md must be chosen carefully. In fact, it should probably vary with the amount of user volume the protocol has on each asset. Consider what happens when timeWindow is very small 5min. A price...

[Pool] - Anyone can remove liquidity from Pools, allowing them to alter the price

Handle adelamo Vulnerability details Impact On the Pool.sol, the function removeForMember is public. Allowing anyone to call the method using an address of an LP in order to remove liquidity from the pools and return to the LP account. If we combine the ability to remove liquidity and being able ...

Flash minting and burning can reduce the paid fees when purchasing a membership or opening a cost share request

Handle shw Vulnerability details Impact Users can pay fewer FSD tokens when purchasing a membership or opening a cost share request by flash minting and burning FSD tokens, which could significantly affect the FSD spot price. Proof of Concept The function getFSDPrice returns the current FSD price...

The First User To Borrow a Particular Token Can Drain Funds In MarginSwap by Making An Undercollateralized Borrow Using Flash Loans

Handle jvaqa Vulnerability details The First User To Borrow a Particular Token Can Drain Funds In MarginSwap by Making An Undercollateralized Borrow Using Flash Loans Impact This attack can be performed with any two ERC20 tokens, where one of them has not yet been borrowed on MarginSwap. Since an...

Russian Hacker Gets 12-Years Prison for Massive JP Morgan Chase Hack

A U.S. court on Thursday sentenced a 37-year-old Russian to 12 years in prison for perpetrating an international hacking campaign that resulted in the heist of a trove of personal information from several financial institutions, brokerage firms, financial news publishers, and other American...

CVE-2020-35962

The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring LRC, an Ethereum token, lacks access control for fee swapping and thus allows price manipulation...

Code injection

The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring LRC, an Ethereum token, lacks access control for fee swapping and thus allows price manipulation...

CVE-2020-35962

The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring LRC, an Ethereum token, lacks access control for fee swapping and thus allows price manipulation...

CVE-2020-35962

The CVE-2020-35962 issue affects Loopring (LRC) by the vault protocol’s sellTokenForLRC function in its smart contract, which lacks access control for fee swapping. This vulnerability enables price manipulation within the on-chain logic. The documented impact is a HIGH severity in CVSS 3.1 (I:H) ...

CVE-2021-3006

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

Design/Logic Flaw

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

CVE-2021-3006

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

CVE-2021-3006

The CVE-2021-3006 entry concerns the Seal Finance (Seal) Ethereum token. The breed function in its smart contract lacks access control, enabling price manipulation. Exploitation occurred in the wild during December 2020 and January 2021. The available documents confirm the root cause (unauthorize...

CVE-2021-3006

The breed function in the smart contract implementation for Farm in Seal Finance Seal, an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021...

Seal Finance Farm Security Breach

Seal Finance Farm is a network protocol used by the Seal Finance community to support decentralized trading.SEAL An experimental protocol that acts as an intermediary between the main DeFi protocol tokens, creating deeper liquidity between the two Seal Finance Farm has a security vulnerability. T...

Two Russians Charged in $17M Cryptocurrency Phishing Spree

U.S. authorities today announced criminal charges and financial sanctions against two Russian men accused of stealing nearly $17 million worth of virtual currencies in a series of phishing attacks throughout 2017 and 2018 that spoofed websites for some of the most popular cryptocurrency exchanges...

Zomato: Ability to manipulate price with a max threshold of `<1 Rupee` in support rider parameter

Hi Team I have found an issue in support rider amount calculation at the time of checkout where the amount is tamperable by negative fraction of rupees which makes the total amount decreased by maximum of 1rs. POC - 1-Goto - zomato.com 2 - Add anything to your cart 3- At the checkout page , Add...

EUC Security Breach

EUC is an ethereum-based digital currency. A security vulnerability exists in the fallback function in EUC's smart contract implementation. An attacker could exploit the vulnerability by setting the selling price to a large value to execute arbitrary code on the system...

SwftCoin has a logic flaw vulnerability

SwftCoin SWFTC is an ethereum-based virtual currency. The 'buy' function in SWFTC's smart contract implementation has a security vulnerability that stems from the fact that an attacker can specify the price at which to buy. The vulnerability can be exploited by an attacker to cause financial loss...