Upgraded Q -> M from 270 [1657580410834]

Judge has assessed an item in Issue 270 as Medium risk. The relevant finding follows: 6.L- Admin config ProtocolFee and gasFee missing max amount check which can be used to take fund from user With PROTOCOLFEEBPS 10000 more than 100%, the exchange can steal user WETH who might approve max WETH...

Malicious code in p2p-amount-field (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c708cc5ca0100211486fde89b6f6ed0a2e1bf6458524412d0cf66ab6b5698839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5172 Malicious code in p2p-amount-field (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c708cc5ca0100211486fde89b6f6ed0a2e1bf6458524412d0cf66ab6b5698839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tinkoff-react-bui/input-amount-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1b086c983cecdbf1e8f97a2d60a171c07c328710ce3aad027dd2f891d2a01a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tinkoff-react-bui/input-amount (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 994a0a8ffc92c84a5dead72060244e1408f9bdd16a86a402bdcd3e044bf7c29e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-657 Malicious code in @tinkoff-react-bui/input-amount-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1b086c983cecdbf1e8f97a2d60a171c07c328710ce3aad027dd2f891d2a01a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pp-amount-field (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25fda0186ce26a0871fe78f3ec99900b6d2f42baa4d4ecb6ea1590d3076b8386 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5432 Malicious code in pp-amount-field (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25fda0186ce26a0871fe78f3ec99900b6d2f42baa4d4ecb6ea1590d3076b8386 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Incorrect accounting results in loss of user stake

Lines of code InfinityStaker.solL116-L131 InfinityStaker.solL290-L325 Vulnerability details Impact In InfinityStaker.sol, when calling the unstake function updateUserStakedAmounts is called to readjust the user staked amounts. If a user stakes an amount in a duration and has an already vested amo...

The timestamp of the specified duration is reset after the position is added via stake().

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. I noticed that the stake amount change in stake is +=, which means that the project itself defaults to adding positions at the same duration, but the timestamp of the duration is overwritten by =...

Should it transfer underSpentAmount to _msgSender() instead of reserve?

Lines of code Vulnerability details Impact underSpentAmount is dust amount, if being transferred to reserve without any state modification. These tokens might be lost. Normally, dust amount must transfer back to only msgSender as a best practice. Proof of Concept unchecked uint256 underSpentAmoun...

Low Value Definition On The Slippage

Lines of code Vulnerability details Impact Trades can happen at a bad price and lead to receiving fewer tokens than at a fair market price. The attacker's profit is the protocol's loss. Proof of Concept MyStrategy contract has low slippage checks which can lead to being vulnerable to sandwich...

Fulfilling an order more than once

Lines of code Vulnerability details Impact Any non basic or FULL order can be fulfilled more than once, assuming the offerer has approved the contract the right amounts. This is a valid assumption as users may max-approve the contract/conduits, or have multiple orders with the same items open so...

Does not set the offerer as the recipient if execution amount is nonzero

Lines of code Vulnerability details Impact Order structures will be corrupted through invalid fulfillment application logic. Proof of Concept Tools Used Manual inspection Recommended Mitigation Steps Change to // Set the offerer as the receipient if execution amount is nonzero. if...

BathToken.sol A malicious early user/attacker can manipulate the vault's pricePerShare to take an unfair share of future users' deposits

Lines of code Vulnerability details function deposituint256 assets, address receiver internal returns uint256 shares uint256 pool = underlyingBalance; uint256 before = underlyingToken.balanceOfaddressthis; // Assume caller is depositor underlyingToken.transferFrommsg.sender, addressthis, assets;...

Input validation

Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploit this vulnerability to manipulate the total order amount into a negative number and then pay for the order...

CVE-2021-26631 Mangboard parameter modulation vulnerability

Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote attacker can exploit this vulnerability to manipulate the total order amount into a negative number and then pay for the order...

CVE-2021-26631

The CVE-2021-26631 entry concerns Mangboard commerce package: an improper input validation vulnerability that allows a remote attacker to manipulate an order’s total amount to a negative value and complete payment. Public sources mention affected versions prior to 1.3.8 (CNNVD), with additional d...

Withdraw all with amount: type(uint256).max in native token (ETH) will always revert

Lines of code Vulnerability details if amount == typeuint256.max uint256 decimal = IERC20Detailedasset.decimals; amount = amountToWithdraw.multhis.pricePerShare.div10decimal; Per the comment: The asset address for collateral asset = 0x0000000000000000000000000000000000000000 means to use ETH as...

Lido adapter incorrectly calculates the price of the underlying token

Lines of code Vulnerability details Impact The Lido adapter incorrectly calculates the price of WETH in terms of WstETH. The function returns the price of WstETH in terms of stETH. The underlying token which we desire is WETH. Since stETH does not have the same value as WETH the output price...