4994 matches found
Precision loss in getRsETHAmountToMint
Lines of code Vulnerability details Impact users may lose their assets Proof of Concept The price of rsETH increases against ETH price, this leads to precision loss in getRsETHAmountToMint. Consider a scenario that one rsETH worth 10 ETH; now if a user tries to deposit 9 ETH he losses assets due ...
Changing rsETH address breaks contract
Lines of code Vulnerability details Impact manipulating rsETH price Proof of Concept admin can change rsETH token address, while total supply of rsETH is used to calculate its price changing rsETH address changes its price. Tools Used Manual Review Recommended Mitigation Steps prevent changing...
The staker could silently lose all their previously deposited assets when revert TokenTransferFailed() is called
Lines of code Vulnerability details Impact The staker could silently lose all their deposited assets in the NodeDelegator.sol function when they time to transfer their assets. This could happen when the staker owns assets in the Eigen but it is not enough to be transferred when the calculated...
Missing pause check in transferAssetToNodeDelegator()
Lines of code Vulnerability details Summary The function transferAssetToNodeDelegator present in the LRTDepositPool contact ignores the contract's pause state. Impact The LRTDepositPool contract contains a functionality to pause the contract in case of an emergency. 208: function pause external...
Precision loss in getRSETHPrice
Lines of code Vulnerability details Impact Precision loss and return zero price by Oracle Proof of Concept Since the value of staked ether increases, the price of RSETH goes above ETH price and leads to a precision loss in the getRSETHPrice function of the oracle, and RSETH price becomes zero...
Winner of auction status is not set to false after claim so eligible for refund
Lines of code Vulnerability details Impact Bidders funds will get stuck Proof of Concept After Auction winner claims token, his/her status is not set to false so he is eligible for a refund because the refund logic checks for all indexes with status set to true, which not supposed to be so. So th...
Risk of Permanent ETH Loss for Bidders
Lines of code Vulnerability details Impact There's a risk of ETH becoming irretrievably locked in the contract if a bidder's address is a contract with either complex logic in its receive function or no receive function at all. In such cases, ETH transfers to these addresses could fail and result...
Re-enterancy in AuctionDemo contract
Lines of code Vulnerability details Impact claimAuction function of AuctionDemo contract transfers the token to highest bidder winner and the bid amount is transferred to the owner. Moreover, refund is sent to all remaining participants non-winners of the auction via call function. However, if a...
CVE-2023-28987
Cross-Site Request Forgery CSRF vulnerability in Wpmet Wp Ultimate Review plugin = 2.0.3 versions...
CVE-2023-28987
Cross-Site Request Forgery CSRF vulnerability in Wpmet Wp Ultimate Review plugin = 2.0.3 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Wpmet Wp Ultimate Review plugin = 2.0.3 versions...
CVE-2023-28987 WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Wpmet Wp Ultimate Review plugin = 2.0.3 versions...
CVE-2023-28987
CVE-2023-28987 is a CSRF vulnerability in the WordPress plugin Wp Ultimate Review (Wpmet Wp Ultimate Review) affecting versions <= 2.0.3. The issue allows an attacker to perform unintended actions on behalf of an authenticated or unauthenticated user, depending on context, due to CSRF flaws de...
CVE-2023-28987 WordPress Wp Ultimate Review Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Wpmet Wp Ultimate Review plugin = 2.0.3 versions...
WordPress Plugin Wp Ultimate Review Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
User loss his delegated voting power after delegation to another user.
Lines of code Vulnerability details Vulnerability Details When a user delegate voting power to another user, his previous voting power from delegation has been ignored at getVotingPowerAt since in case isDelegated is true getVotingPowerAt returns 0. Impact Delegated voting power cannot be utilize...
decreaseTotalVotingPower - If totalVotingPower becomes less than mintedVotingPower, the protocol crashes(even can lose assets)
Lines of code Vulnerability details Impact If totalVotingPower getSharedProposalStorage.governanceValues.totalVotingPower -= votingPower; 1. Tak...
Users can lose eth when contributing.
Lines of code Vulnerability details Impact When contributing in InitialETHCrowdfund, if minting adjusts the voting power for that user to cap it at totalVotingPower, the user does not get refunded the eth he lost. Proof of Concept PartyGovernanceNFTmint caps the mintedVotingPower at...
Google Launches Verification Badges for Security Tested VPN Apps
By Deeba Ahmed The new feature will add an Independent Security Review badge at the top of the Google Play search results page when users search for VPN apps. This is a post from HackRead.com Read the original post: Google Launches Verification Badges for Security Tested VPN Apps...
Google Play Store Highlights 'Independent Security Review' Badge for VPN Apps
Google is rolling out a new banner to highlight the "Independent security review" badge in the Play Store's Data safety section for Android VPN apps that have undergone a Mobile Application Security Assessment MASA audit. "We've launched this banner beginning with VPN apps due to the sensitive an...