Malware in cosmos-wallet-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in minotari_wallet_ff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48f015d501f7fda235545da39cb174ad6dfd4de2416ecb639a39644fd44618b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Holder cannot claim fee

Lines of code Vulnerability details Impact Assume a user buys some shares and mints it to an NFT and sends the shares to a cold wallet for safety. The following happens: A user buys 10 shares using buy is called, the rewardsLastClaimedValue is updated to the latest holder rewards, the...

Potential drain of EthCrowdFund contract

Lines of code Vulnerability details Impact In the emergencyExecute function in the EthCrowdFundBase contract, the external call msg.value is decided by the user input which could lead to draining of funds by compromised wallet or human error. Also there is no check if the value of amoutnEth is at...

Nonce is not incremented after using signature for policy validation

Lines of code Vulnerability details Impact Nonce is not incremented after using signature for policy validation Proof of Concept In PolicyValidator.sol there is a function function isPolicySignatureValid address account, address to, uint256 value, bytes memory data, Enum.Operation operation, byte...

Fantom Foundation Suffers Wallet Hack Via Google Chrome 0-Day Flaw

By Waqas The Fantom Foundation has acknowledged the breach and is currently conducting an investigation after hackers managed to steal more than $550,000 in cryptocurrency. This is a post from HackRead.com Read the original post: Fantom Foundation Suffers Wallet Hack Via Google Chrome 0-Day Flaw...

WS-2023-0345

There is a UAF Use After Free vulnerability in the renderer implementation of the Ethereum wallet in Brave. When the Ethereum wallet is connected, every V8 render gets this piece of code installed, creating a new object ethereum accessible from V8. This may lead to Code Execution on the renderer...

if the Virtual Account's owner is a Contract Account (multisig wallet), attackers can gain control of the Virtual Accounts by gaining control of the same owner's address in a different chain

Lines of code Vulnerability details Impact Attackers can gain control of User's Virtual Accounts and steal all the assets these accounts hold in the Root environment Proof of Concept When sending signed messages from a Branch to Root, the RootBridgeAgent contract calls the...

Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fund

Lines of code Vulnerability details Impact Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fun Proof of Concept One of the cross-chain request pass is that when user calling callOutSignedAndBridge via BranchBridgeAgent the payload is created //Encode Data for...

VirtualAccount as a wallet can be called by anyone

Lines of code Vulnerability details A VirtualAccount represents a user wallet that allows the user to manage assets and perform remote interactions. But because payableCall method lacks any form of authentication it can be called by anyone. The call can be also executed directly to the desired...

MultiBit HD Security Vulnerability

MultiBit HD is a bitcoin wallet open-sourced by MultiBit. A security vulnerability exists in versions prior to MultiBit HD 0.1.2 that stems from not setting the Message Authentication Code MAC...

Steer clear of cryptocurrency recovery phrase scams

The dangers of cryptocurrency phishing are back in the news, after tech investor Mark Cuban was reported to have lost around $870k via a phishing link. Cuban lost a combination of coin types as asset movement flagged up after months of inactivity from his wallet. Cuban discovered some of the...

Brave Android 1.58.125 Security Fixes

Fixed Brave Wallet pop-up hiding the full screen toast as reported on HackerOne by shadow2639. Upgraded Chromium to 117.0.5938.62 — refer to Google Chrome advisories for inherited CVEs...

The vulnerability of the Wallet component in operating systems such as iOS, iPadOS, and watchOS allows a hacker to execute arbitrary code.

The vulnerability of the Wallet component in operating systems such as iOS, iPadOS, and watchOS is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading specially crafted attachments...

Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability

Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064...

About the security content of watchOS 9.6.2

About the security content of watchOS 9.6.2 This document describes the security content of watchOS 9.6.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

PT-2023-5027

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 16.6.1 Apple iPadOS versions prior to 16.6.1 Apple watchOS versions prior to 9.6.2 Description A validation issue was addressed with improved logic. This issue may result in arbitrary code execution when a malicious...

VulnCheck KEV: CVE-2023-41061

Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064...

About the security content of iOS 16.6.1 and iPadOS 16.6.1

About the security content of iOS 16.6.1 and iPadOS 16.6.1 This document describes the security content of iOS 16.6.1 and iPadOS 16.6.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

Cryptocurrency Startup Loses Encryption Key for Electronic Wallet

The cryptocurrency fintech startup Prime Trust lost the encryption key to its hardware wallet--and the recovery key--and therefore $38.9 million. It is now in bankruptcy. I cant understand why anyone thinks these technologies are a good idea...