_from and _to can be the same address on wrap() function

Handle jayjonah8 Vulnerability details Impact In WJLP.sol, the wrap function pulls in amount base tokens from from, then stakes them to mint WAssets which it sends to to. It then updates rewardOwner's reward tracking such that it now has the right to future yields from the newly minted WAssets. B...

Anyone can liquidate credit line when autoLiquidation is false without supplying borrow tokens

Handle harleythedog Vulnerability details Impact It is intended that if a credit line has autoLiquidation as false, then only the lender can be the liquidator see docs here: . However, this is not correctly implemented, and anyone can liquidate a position that has autoLiquidation set to false. Ev...

StartTimestamp is not checked

Handle defsec Vulnerability details Impact When the promotion is created, the promotion.startTimestamp variable can be so old date. That will cause to affect to epoch calculation. Proof of Concept 1. Navigate to the following contract code. promotionsnextPromotionId = Promotion msg.sender, ticket...

lemlist: [app.lemlist.com] Improper handling of payment lead to bypass payment

Summary: Hello Team, I truly hope it treats you awesomely on your side of the screen : due to improper handling of payment methods, an attacker can easily bypass the payment and benefit from a paid plan. Steps To Reproduce: 1. Log to your account 1. Go to the billing page 1. Fill in the address t...

AbstractRewardMine.sol#setRewardToken is dangerous

Handle 0x0x0x Vulnerability details Impact In case the reward token is changed, totalDeclaredReward will be changed and likely equal to 0. Since userStakePadding and globalStakePadding are accumulated, changing the reward token will not reset those values. Thus, it will create problems...

No bound on marginRewardRate

Handle gzeon Vulnerability details Impact There is no check when setting marginRewardRate, if it is set to any value FixedPoint.ONE i.e. 1e18 it would lead to underflow at L403 Proof of Concept Recommended Mitigation Steps Add related check in setMarketInfo --- The text was updated successfully,...

Key buyers will not be able to get refund if lock manager withdraws profits

Handle kenzo Vulnerability details Unlock contains a feature in which a key buyer can ask for a refund. The refund is sent from the lock - where the purchase funds were sent. The lock manager can withdraw all funds from the lock. Therefore, if the lock manager withdraws enough profits from the...

isUnderwater returns opposite boolean for short positions

Handle harleythedog Vulnerability details Impact The function isUnderwater should return true iff the position value is 0. In the case of a short position, this is when oi 2 - priceFrame - debt 0 based on the logic given in the value function. Rearranging this equation, a short position is...

Two-step change of an admin address

Handle pauliax Vulnerability details Impact function setAdmin allows the current admin to change it to a different address. If accidentally an invalid address is used for which they do not have the private key, then it cannot be corrected and none of the functions that require admin caller can be...

Avoid Using Block.timestamp in checkClaimable

Handle Koustre Vulnerability details Impact checkClaimable function is dependent on using block.timestamp and this can be manipulated to claim funds earlier than it should in functions claim, forceClaim and lock Proof of Concept Provide direct links to all referenced code in GitHub. Add...

Change in interest rate can disable repay of loan

Handle pmerkleplant Vulnerability details Impact The ability of a borrower to repay a loan is disabled if the interest rate is set too high by the InterestRateModel. However, there is neither a check when setting the interest rate nor an indication in the IInterestRateModel's specs of this...

Prevent execution with invalid signatures

Handle gpersoon Vulnerability details Impact Suppose one of the supplied addrsi to the constructor of Identity.sol happens to be 0 by accident. In that case: privileges0 = 1 Now suppose you call execute with an invalid signature, then recoverAddrImpl will return a value of 0 and thus signer=0. If...

Summarize your findings for the bug or vulnerability

Handle AC0611 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...

Basket becomes unusable if everybody burns their shares

Handle kenzo Vulnerability details While handling the fees, the contract calculates the new ibRatio by dividing by totalSupply. This can be 0 leading to a division by 0. Impact If everybody burns their shares, in the next mint, totalSupply will be 0, handleFees will revert, and so nobody will be...

Samsung SMR 安全漏洞

Samsung SMR is a system patch package from Samsung South Korea. The patch program is provided for Samsung mobile applications. A security vulnerability exists in Samsung SMR that originates when a networked system or product performs an operation on memory without properly validating data...

HolesWarm Malware Exploits Unpatched Windows, Linux Servers

By leveraging more than 20 known vulnerabilities in Linux and Windows servers, the HolesWarm cryptominer malware has been able to break into more than 1,000 cloud hosts just since June. The basic cryptominer botnet has been so successful at juggling so many different known vulnerabilities between...

Cross-Site Request Forgery (CSRF) in admidio/admidio

✍️ Description Attacker able to delete any photo of a user with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF...

Elastic: blind Server-Side Request Forgery (SSRF) allows scanning internal ports

A blind Server-Side Request Forgery SSRF vulnerability was found on a website, allowing an attacker to scan internal ports. The vulnerability could not be used to read HTTP responses, but could be used for reconnaissance purposes, such as port scanning by measuring response time...

Allowance cannot be reset once it is set to the maximum

Handle shw Vulnerability details Impact The approve functions of the pool LP tokens and synths do nothing if the allowances is already the maximum number, i.e., typeuint256.max. Therefore, Alice cannot change her allowance to Bob once she approved him with the maximum approval. Proof of Concept...

CVE-2021-30116

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client...