ERC1155.isApprovedForAll(owner, receiver) logic means it is possible for an approved receiver to withdraw more shares than expected

Lines of code Vulnerability details In the Readme, it is mentioned a receiver can call withdraw on behalf of the shares owner we accept deposits and withdraws on behalf of other users, by using approve ERC1155 functions on withdraw, and recipient/owner params inside both deposit/withdraw function...

A malicious user could stuck crowdfund ETH

Lines of code Vulnerability details Impact A user could freeze funds accumulated in a crowdfund and execute a "fake sale" that would be the approval of the token. Proof of Concept A group of users create a crowdfund, they raise money to buy the most good looking Bored Ape. An attacker would buy i...

Griefing attack on the Vaults is possible, withdrawing the winning side stakes

Lines of code Vulnerability details Anyone can withdraw to receiver once the receiver is isApprovedForAllowner, receiver. The funds will be sent to receiver, but it will happen whenever an arbitrary msg.sender wants. The only precondition is the presence of any approvals. This can be easily used ...

TRSRY: front-runnable setApprovalFor

Lines of code Vulnerability details Impact An attacker may be able to withdraw more than intended Proof of Concept Let's say the alice had approval of 100. Now the treasury custodian reduced the approval to 50. Alice could frontrun the setApprovalFor of 50, and withdraw 100 as it was before. Then...

Multiple Withdrawal Attack Vector in TRSRY.sol

Lines of code Vulnerability details Impact Multiple Withdrawal Attack Vector in TRSRY.sol Proof of Concept The TRSRY.sol has setApprovalFor method to set approval for specific withdrawer addresses. The function is as below; function setApprovalFor address withdrawer, ERC20 token, uint256 amount...

Swap at the lower cushion is impossible due to non approved withdrawal. Wrong implementation can cause free swaps.

Lines of code Vulnerability details Impact Currently it is not clear how the swap user is approved for withdrawing from treasury. Depending on implementation, user could swap without spending any tokens, due to approval mechanism in the TRSRY module. Description In the swap function it should be...

The users are not able to withdraw the swapped amount

Lines of code Vulnerability details Impact The user will invoke swap from Operator.sol to swap their OHM tokens. But he will transfer their OHM and will never get the AmountOut Proof of Concept On Operator.sol: 1- invoking swap with tokenIn == ohm 2- the ohm.safeTransferFrommsg.sender, addressthi...

Zero approval missing

Lines of code Vulnerability details Impact Frontrunning is possible where user withdraw money before setApproval refill the approval limit. This allows User to get more funds than required Proof of Concept 1. User A is approved an amount of 50 2. "custodian" decides to reduce the approval amount ...

WordPress Robo Gallery 3.2.1 plugin - Bypass POST comment approvement Vulnerability

Title: WordPress 6.0 - Bypass POST comment approvement Robo Gallery 3.2.1 Author: nu11secur1ty Vendor: https://wordpress.org/ Software: https://wordpress.org/plugins/robo-gallery/ Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/RoboGallery Description:...

SideFX: Stored XSS in messages

The security issue described involves a stored cross-site scripting XSS vulnerability in the message functionality of the system. The vulnerability allowed an attacker to inject malicious code into messages, which could be executed when the victim viewed the message. This resulted in the attacker...

Can add member and publish project to future community without community owner approval

Lines of code Vulnerability details Impact Anyone can add himself as a member of community for any future community. This can be done due to a combination of facts: Non initialized address storage values are defaulted to address0 addMember doesn't check if community is already created...

Approve will fail

Lines of code Vulnerability details Impact Multiple ERC20 tokens require zero address approval before approving the required amount. The contract seems to be missing this. Proof of Concept 1. Observe the receiveAndSendNative function at ReceiverImplementation.sol...

Approval from non-zero to non-zero amount can lead to DoS

Lines of code Vulnerability details Impact Some tokens like USDT do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance must be approved. Proof of Concept The following function use an unsafe approvement...

GHSA-G86G-CHM8-7R2P check-spelling workflow vulnerable to token leakage via symlink attack

Impact For a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the GITHUBTOKEN, it's possible to push commits to the repository bypassing standard approval...

SUSE-SU-2022:2595-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: Various FIPS 140-3 related fixes were backported from SUSE Linux Enterprise 15 SP4: - Makes the PBKDF known answer test compliant with NIST SP800-132. bsc1192079. - FIPS: Add on-demand integrity tests through sftkFIPSRepeatIntegrityCheck...

openSUSE: Security Advisory for mozilla-nss (SUSE-SU-2022:2533-1)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Allowance should always larger or equal to the transferred amount

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Wrong operators are set. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Line 111 - 115 if allowe...

Cannot withdraw or redeem approved tokens

Lines of code Vulnerability details Title Cannot withdraw or redeem approved tokens Impact A contract/EOA which has been approved some ZcToken cannot redeem or withdraw the approved tokens since these functions always revert if msg.sender != holder. Proof of Concept In the withdraw function...

Don't trust in references contracts

Lines of code Vulnerability details Impact The references contracts don't check anything, and the function receive a lot of parameters to manipulate the call Proof of Concept If somebody approveERC20/777/721/1155 the TransferReference contract or use a delegatecall the tokens can be stolen...

Incorrect condition will always fail withdrawal

Lines of code Vulnerability details Impact Due to an incorrect approval check, the if condition will always lead to transaction reversal when withdrawal is requested for a holder who is not msg.sender. This can lead to user unable to withdraw funds Proof of Concept 1. Let us see the withdraw...