onERC721Received() could delegatecall to transder the tokens

Lines of code Vulnerability details onERC721Received could delegatecall to transder the tokens Impact Some onERC721Received could use delegatecall to drain the tokens Putty holds. Because the msg.sender is Putty contract, the tarnsfer can go through. Or taking the ownership of the Putty contract...

Upgraded Q -> H from 215 [1656255310294]

Judge has assessed an item in Issue 215 as High risk. The relevant finding follows: L-09 wfCashERC4626 contract does not conform to EIP4626 Description The wfCashERC4626 contract implements the EIP4626 standard EIP-4626: Tokenized Vault Standard. However, according to EIP4626, the below-mentioned...

The vulnerability of the Database Vault component of the Oracle Database Server database management system allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the Database Vault component of the Oracle Database Server system exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected data using the HTTP protocol...

MAL-2022-1348 Malicious code in azure-keyvault-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 660172679fceb48d3856a6f9ac67e02a6917f304c430020232753ee280ed7d64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1350 Malicious code in azure-keyvault-keys-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3de0c04b9047a448fde22ce214893b20493e320d70c968f9f15732f471604e35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1347 Malicious code in azure-keyvault-certificates-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d4a4dd27ca78c3baf11188004219aee2dde382de300b316e2276af5c2613b81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1344 Malicious code in azure-keyvault-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf46a9acf272f8e1a3fae7857b3808f0e8b28748ad3ddc58ef42ff1286ed07e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-certificates-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95f4c241905d9e557472c20ba2fce0d7a9246b1fd912f2b680a906e98699f866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1351 Malicious code in azure-keyvault-secrets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be944ac1c65267da56d78a4f4ffb7b8561cc85353d589c7df16f6ebfbcb5e568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1352 Malicious code in azure-keyvault-secrets-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 443a37add60cd6a3bd78fb9c4c91e1b5d9d836a32e0fcef0bc7e556dc6e15d4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1353 Malicious code in azure-keyvault-secrets-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e42b406b432ef2a203d09a5021bfb45c41a0d1af43c7f4436d87956264f7706 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-keyvault-admin-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c6895fa55849501987a9fd8669e21d952f6d1e7aa884e5184c0d6858d12dd33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1341 Malicious code in azure-keyvault-admin-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75f9fc7c022ef300d02bd184ffb71a0a0502d64d13bb5df78992a2af90d740cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1346 Malicious code in azure-keyvault-certificates-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 882fdc11d87cda82ea735448d1e1a0fa7213cac0a11c7ae7c974ba3ecb523c34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pancake-cake-vault (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4911af300b562bcf8849d8ac6a0764e01ecb653a7f3bc39955b489a5ce1efd89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5201 Malicious code in pancake-cake-vault (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4911af300b562bcf8849d8ac6a0764e01ecb653a7f3bc39955b489a5ce1efd89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious relayer could exploit sponsor vaults

Lines of code Vulnerability details Impact Sponsor vaults drained Proof of Concept reimburseRelayerFees uses SponsorVault funds to repay users the fees they pay to relayers. A malicious relayer could create a large number of transactions with the max reimbursed relay fee specified in SponsorVault...

Withdrawing all funds at once to vault can be DoS attacked by frontrunning and locking dust

Lines of code Vulnerability details Impact All funds can be migrated withdrawn at once to the caller vault by using the BaseStrategy.withdrawToVault function which internally calls MyStrategy.withdrawAll. The latter function has the following check in place: MyStrategy.solL184-L187 require...

Should also check balanceOfRewards in _withdrawAll()

Lines of code Vulnerability details Impact withdrawAll should check that all of your positions are unwinded. It does check balanceOfPool and LOCKER.balanceOf. Then withdrawToVault in BaseStrategy.sol can transfer all want to the vault. But it doesn’t check reward tokens. want could also be one of...

Yearn Curve vault can be removed without withdrawing all deposited tokens. Causing these token to be locked forever unless an owner is added this vault back.

Lines of code Vulnerability details Impact Yearn Curve vault can be removed without withdrawing all deposited tokens. Causing these token to be locked forever unless an owner is added this vault back. Proof of Concept function removeVaultaddress vault external onlyOwner requirevaultsvault !=...