Token Transfers Are Not Handled Correctly

Lines of code Vulnerability details Impact The transfer function is used to send royalty assets to the splitter contract and its recipients. If the vault operates on non-standard ERC20 tokens, its possible for transfers to not revert upon failure. Similarly, transferFrom is used to pull funds fro...

Reentrancy in ConcurRewardPool::claimRewards

Lines of code Vulnerability details Impact Any address that has nonzero reward for a token tokensi is able to drain all contact token funds if the transfer function is reentrant for example, ERC777 token. As tokensi is an arbitrarily implemented, a reentrant transfer function can be assumed to be...

Transfer function is unreliable

Handle Koustre Vulnerability details Impact Opcode pricing is not stable and should not be relied upon to protect against re-entrancy attacks. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept...

Erc20.transfer() return value is ignored

Handle pants Vulnerability details According to the ERC-20 Token Standard, the function transfer returns false on failure. However, the return value of Erc20.transfer is ignored 8 times: 1. In Swivel.exitVaultFillingZcTokenExit, line 313. 2. In Swivel.exitVaultFillingZcTokenExit, line 315. 3. In...

Rewards accumaulated can stay constant and oftern not increment

Handle moose-code Vulnerability details Impact rewardsPerToken.accumulated can stay constant while rewardsPerToken.lastUpdated is continually updated, leading to no actual rewards being distributed. I.e. No rewards accumulate. Proof of Concept Line 115, rewardsPerToken.accumulated could stay...

Unchecked return value from transfer()

Handle JMukesh Vulnerability details Impact It is usually good to add a require-statement that checks the return value or to use something like safeTransfer; unless one is sure the given token reverts in case of a failure. Proof of Concept Tools Used manual review Recommended Mitigation Steps che...

CVE-2021-33403

An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses between two large accounts during a transaction...

instead of call() , transfer() is used to withdraw the ether

Handle JMukesh Vulnerability details Impact function withdrawuint amount external requireamount = ethBalancemsg.sender; ethBalancemsg.sender = ethBalancemsg.sender.subamount; msg.sender.transferamount; emit Withdrawmsg.sender, amount; To withdraw eth it uses transfer, this trnansaction will fail...

Bypass or reduction on the lockup period of Pool FDTs.

Handle shw Vulnerability details Editing on a previous submission to clarify more details Impact In Pool.sol, the lockup restriction of withdrawal Pool.sol396 can be bypassed or reduced if new liquidity providers cooperate with existing ones. Proof of Concept 1. A liquidity provider, Alice,...

Pandora Digital Error Vulnerability

Pandora PDX is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'transfer' and 'transferFrom' functions in the smart contract implementation of PDX. An attacker could exploit the vulnerability to set a user's balance to an arbitrary value...

The vulnerability of the TIFFWriteDirectoryTagTransferfunction function in software for viewing, editing, and converting TIFF files arises from the possibility of an operation exceeding the permissible buffer data size. This vulnerability allows attackers to cause service failures.

The vulnerability of the TIFFWriteDirectoryTagTransferfunction function in software for viewing, editing, and converting TIFF files is related to the operation exceeding the allowable buffer data size. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

Linux kernel denial of service vulnerability (CNVD-2020-28264)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the drivers/spi/spi-dw.c file in Linux kernel versions prior to 5.4.17. An attacker can exploit this vulnerability to cause a denial...

Easy Trading Token Digital Error Vulnerability

Easy Trading Token ETT is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'transfer' and 'transferFrom' functions in ETT's smart contract implementation. . An attacker can exploit this vulnerability to modify arbitrary amounts...

Pandora Digital Error Vulnerability

Pandora PDX is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'transfer' and 'transferFrom' functions in the smart contract implementation of PDX. An attacker could exploit the vulnerability to set a user's balance to an arbitrary value...

ChuCunLingAIGO Digital Error Vulnerability

ChuCunLingAIGO CCLAG is an ethereum-based digital currency.The 'transfer' and 'transferFrom' functions in CCLAG's smart contract implementation suffer from an integer overflow vulnerability. An attacker could use this vulnerability to set a user's balance to an arbitrary value...

PFGc Number Error Vulnerability

PFGc is an ethereum-based digital currency.An integer overflow vulnerability exists in the smart contract implementation of PFGc in the 'transfer', 'transferFrom', and 'mint ' functions in the PFGc smart contract implementation suffer from an integer overflow vulnerability. An attacker could...

Logic Flaw Vulnerability in FuturXE

FuturXE FXE is an ethereum-based virtual currency.A security vulnerability exists in the 'transferFrom' function in FXE's smart contract implementation, which stems from a logic error in the program. An attacker could exploit the vulnerability to make an unauthorized transfer of digital assets...

CVE-2018-14779

A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function ykpivtransferdata: % highlight c % ifoutlen + recvlen - 2 maxout fprintfstderr, "Output buffer to small, wanted to write %lu, max was %lu.", outlen +...

Integer overflow

An integer overflow vulnerability exists in the function transfertokensafterICO of GlobeCoin GLB, an Ethereum token smart contract. An attacker could use it to set any user's balance...

Bittelux Number Error Vulnerability

Bittelux BTX is an Ether-based digital currency. An integer overflow vulnerability exists in the 'transfer' and 'transferFrom' functions in the smart contract implementation of BTX. No details of the vulnerability are provided at this time...