Contracts are vulnerable to rebasing accounting-related issues

Lines of code Vulnerability details Impact Rebasing tokens are tokens that have each holder's balanceof increase over time. Aave aTokens are an example of such tokens. If rebasing tokens are used, rewards accrue to the contract holding the tokens, and cannot be withdrawn by the original depositor...

[H] Users can withdraw more tokens than they have staked

Lines of code Vulnerability details Impact Users can withdraw more tokens than they have staked from the contract. In stakerewardV2pool, there is no check to stop a user from withdrawing more tokens than they have staked. The tokens are simply subtracted from the user's balance and from the total...

Reentrancy may allow a customer to steal funds

Lines of code Vulnerability details Impact The reentrancy in the vested token can be used by a customer if the execution can be hijacked before the balance change occurs. Let’s consider function withdraw. Firstly, the balance is checked and then if there is enough token surplus to withdraw, the...

Vega's validators able to submit duplicate transactions

A vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For example, a deposit to the collateral bridge for 100USDT that credits a party’s general account on Vega, can be re-processed 50 times resultin...

Cross contract reentrancy attack through changing the xDomainMsgSender

Lines of code Vulnerability details Impact The use of the guaranteed safe CrossDomainMessenger for withdrawals can result in permanent blockages when the recipient address interacts with external addresses, which is an important feature for interoperability and is expected to be widely utilized...

Bug on e handling of excess ETH deposits

Lines of code Vulnerability details The StaderStakePoolsManager contract contains a critical bug that could lead to financial loss and system instability. The bug is related to the handling of excess ETH deposits and the calculation of available ETH for new deposits. Bug Description: In the...

Manager and DEFAULT_ADMIN_ROLE can create a scenario where user deposits more than he is permitted to withdraw

Lines of code Vulnerability details Impact manager and DEFAULTADMINROLE can update conflicting values as max deposit limit and max withdrawal limit, where maxDepositAmount is than maxWithdrawAmount. Users will be able to deposit more than they are permitted to withdraw. considering the extremes i...

Technically the seven days period is not guaranteed and it's possible for the challenger to delete a withdrawal even if it hasn't been challenged during the seven days

Lines of code Vulnerability details Proof of Concept There's an existing logic to prevent the CHALLENGER from deleting a l2Output after the finalization period has ended. This is done to prevent having user withdrawals blocked after the finalization period has elapsed without challenges. The...

Withdrawal with gas limit more than 28_750_517 can never be executed with CrossDomainMessenger

Lines of code Vulnerability details Impact Withdrawal with gas limit more than 28750517 can never be executed with CrossDomainMessenger. User that will initiate such withdrawal will loose his funds and will not be able to execute the withdrawal, because of reaching maximum block gas limit. Proof ...

Attacker can frontrun user bid with wrong lotId and create the lot with that lotId, forcing the user to take a big loss

Lines of code Vulnerability details Impact User takes a huge loss by getting 1 SD token, but bidding an amount possibly much bigger. Attackers are incetivized to perform this if they are ETHx holders and want to increase the value of their tokens. Proof of Concept When a user adds a bid to the...

NFT withdrawal grief

Lines of code Vulnerability details Impact A lienee whose NFT is not currently on loan may be prevented from withdrawing it. Proof of Concept A lienee who wishes to withdraw his NFT calls withdrawNftWithInterest which tries to IERC721.safeTransferFrom the NFT, which therefore reverts if the NFT i...

Borrowing without paying interest

Lines of code Vulnerability details Impact A lender can be prevented from withdrawing from his lien, without having to pay him interest. Only a few negligible wei have to be paid for technical reasons. This enables the trader to open a risk free position. Long: The trader swaps the NFT in the lie...

Host can instantly set rageQuitTimestamp and prevent members from rage quitting

Lines of code Vulnerability details Impact A malicious Host can front-run rage-quitting members and setRageQuitTimestamp to a time in the past and disable rageQuit. Proof of Concept Ragequit serves as a protective measure for members of a Party to do an emergency withdrawal of their assets in cas...

Risk assessment of the finalizeETHWithdrawal function in the bridge contract

Lines of code Vulnerability details Summary The finalizeBridgeETH function: function finalizeETHWithdrawal address from, address to, uint256 amount, bytes calldata extraData external payable finalizeBridgeETHfrom, to, amount, extraData; is a public function, which means that anyone can call it...

frr security, bug fix, and enhancement update

8.3.1-5 - Resolves: 2147522 - It is not possible to run FRR as a non-root user 8.3.1-4 - Resolves: 2144500 - AVC error when reloading FRR with provided reload script 8.3.1-3 - Related: 2129743 - Adding missing rules for vtysh and other daemons 8.3.1-2 - Resolves: 2128738 - out-of-bounds read in t...

GHSA-J93V-CX26-2XC4 Duplicate Advisory: Cross-site Scripting (XSS) in Predefined Properties delete

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q7cc-m6jw-m262. This link is maintained to preserve external references. Original DescriptionCross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21...

Mitigation of M-08: Issue NOT mitigated

Mitigated issue M-08: Possible DoS on unstake The issue is that a potential time-lock in Rocket Pool may cause RocketTokenRETHInterfacerethAddress.burnamount to revert, which prevents frequent withdrawals and unstakes. Mitigation review Reth.withdraw still calls...

Users can queue a withdrawal and potentially withdraw completely if PAUSED_EIGENPODS_VERIFY_OVERCOMMITTED = false

Lines of code Vulnerability details Impact Users can queue a withdrawal and potentially withdraw completely if PAUSEDEIGENPODSVERIFYOVERCOMMITTED = false Proof of Concept We need to look at two functions. The first one is function verifyOvercommittedStake uint40 validatorIndex,...

Slashing can be frontrunned

Lines of code Vulnerability details Proof of Concept When attempting to withdraw funds, the user calls queueWithdrawal first. queueWithdrawal checks that the caller is not frozen, then marks the withdrawal as pending. function queueWithdrawal uint256 calldata strategyIndexes, IStrategy calldata...

Skipping indices of malicious strategies does not work

Lines of code Vulnerability details Impact In src/contracts/core/StrategyManager.solL536 parameter indicesToSkip per documentation: """exists so that, e.g., if the slashed QueuedWithdrawal contains a malicious strategy in the strategies array which always reverts on calls to its 'withdraw'...