Left ERC20/ETH can be withdrawn by anyone

Lines of code Vulnerability details Impact Any remaining balance can be used by anyone. This can impact on users who transfers directly to the protocol by mistake. Proof of Concept If any user by mistake transfers ERC20/ETH directly not through the ERC20EnabledLooksRareAggregator or execute...

ETH amount that is trapped in LooksRareAggregator contract can be withdrawn by user who is not LooksRareAggregator's owner

Lines of code Vulnerability details Impact When ETH amount is trapped in the LooksRareAggregator contract, such as when someone accidentally sends some ETH to it, the owner of the LooksRareAggregator contract has the privilege to call the rescueETH function to transfer such amount to a proper...

Borrower can put their address when submiting addCredit() which can make the lender not be able to withdraw tokens

Lines of code Vulnerability details Impact when calling addCredit by borrower, they can choose to put in their address as the lender instead of the actuall lender. this can bring problems later on when the lender is trying to withdraw funds from the contract. they wont be able to withdraw the fun...

SpigotLib._claimRevenue is marked public instead of internal

Lines of code Vulnerability details Impact SpigotLib.claimRevenue is marked public instead of internal. This public function is wrapped in the external claimRevenue function. Attacker can call claimRevenue to claim Revenue Tokens into the Spigot escrow for later withradrawal. Tools Used Manual...

Mssing Crucial Checks When Unlocking funds for Withdraw Requests from L2

Lines of code Vulnerability details Impact Atomicity literally does not exist when users from L2 initiate a withdrawal by burning funds on the contract and sending the message to L1. This is giving malicious attackers plenty of time to stealthily launch a series of small and yet sizable forgery o...

Bid can be cancelled after being finalized

Lines of code Vulnerability details Impact The SizeSealed contract's cancelBid function can be called after auction has been finalized, thereby allowing the bidder to withdraw their quoteToken after bid is finalized This is possible by bypassing the if a.data.lowestQuote != typeuint128.max ||...

Some bidders can withdraw would claim moreof the baseToken when auction CliffPercent value is 1

Lines of code Vulnerability details Impact If an auction is created with a.timings.cliffPercent set to 1 , then during withdrawal of baseTokens after auction ends, the some bidders to withdraw would claim more tokens than others of the baseToken amounts. Proof of Concept 1. Auction A is created...

seller can change lowestBaseand lowestQuote and the seller can make it diffrent values causing a dos or loss of funds

Lines of code Vulnerability details Impact When I a seller finalizes the auction they change the lowestQuote and lowestBase.When users withdraw from the auction after the auction is finalized. QuoteBought is calculated with the new amounts which can cause dos or refund their leftover quote amount...

Attacker can steal any funds in the contract by state confusion (no preconditions)

Lines of code Vulnerability details HIGH: Attacker can steal any funds in the contract by state confusion no preconditions LOC: Description Auctions in SIZE can be in one of several states, as checked in the atState modifier: modifier atStateAuction storage a, States state if block.timestamp...

Contracts will not working correctly after February 2106. Vesting will be locked forever if withdrawn after February 2106.

Lines of code Vulnerability details Impact Contracts will not working correctly after February 2106. Migration takes costs and is risky. You shouldn't pass on this work to future programmers. You should fix it in the first place. In case anything went wrong during migration, a big fund loss will...

编号撤回

This CVE number has been withdrawn...

Owner can drain pledged tokens balance with recoverERC20 function

Lines of code Vulnerability details Impact The recoverERC20 function allows the owner to withdraw the ERC20 tokens sent by acceident to the contract but it doesn't allow him to withdraw pldged tokens, the owner though could use the removeRewardToken function to remove a token used currently in a...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

编号撤回

This CVE number has been withdrawn...

编号撤回

This CVE number has been withdrawn...

CVE-2022-3555

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

UBUNTU-CVE-2022-3542

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2022-3532

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...