Attacker can empty all the funds by creating fake promotions

Handle WatchPug Vulnerability details The current implementation of calculateRewardAmount allows a arbitrary epochId, which can even be a epochId numberOfEpochs. A malicious user can call claimRewards with epochIds larger than numberOfEpochs and claim other users' rewards. Furthermore, since...

Lack of access control allow attacker to mintFungible() and mintSynth() with other user's wallet balance

Handle WatchPug Vulnerability details function mintFungible IERC20 foreignAsset, uint256 nativeDeposit, uint256 foreignDeposit, address from, address to external override nonReentrant returns uint256 liquidity IERC20Extended lp = wrapper.tokensforeignAsset; require lp != IERC20ExtendedZEROADDRESS...

Arbitrary contract call allows attackers to steal ERC20 from users' wallets

Handle WatchPug Vulnerability details function fillZrxQuote IERC20 zrxBuyTokenAddress, address payable zrxTo, bytes calldata zrxData, uint256 ethAmount internal returns uint256, uint256 uint256 originalERC20Balance = 0; if!signifiesETHOrZeroaddresszrxBuyTokenAddress originalERC20Balance =...

Sifchain: Private eth key found

Hello, team! Found private ethereum key at file: https://github.com/Sifchain/sifnode/blob/develop/smart-contracts/.env.example This key points to wallet balance: F1284232 As I understood, private key allows to spend this coins, so it may need to be masked or hidden. Impact eth private key disclos...