Griefing attack by transferring aTokens to the contract

Originally part of a QA report by Tadashi 69 Griefing attack by transferring aTokens to the contract Summary: tokenToShares uses the following formula for computing the total shares of an user: return supply == 0 ? tokens : tokens.mulsupply.divaToken.balanceOfaddressthis; An attacker wishing to...

Yield source does not correctly calculate share conversions

Lines of code Vulnerability details The aTokens’ value is pegged to the value of the corresponding supplied asset at a 1:1 ratio and can be safely stored, transferred or traded. All yield collected by the aTokens' reserves are distributed to aToken holders directly by continuously increasing thei...

Wrong implementation of AaveYield.sol causing users to lose yields

Handle WatchPug Vulnerability details The current implementation of AaveYield.sol is taking AAVE aToken as a share token eg, cToken and yToken. However, AAVE's aTokens are quite different from cToken and yToken as it's always 1:1 to the underlying token, and the holder's balance will keep changin...

Couchbase Server 安全漏洞

Couchbase Server is a distributed, open source NoSQL non-relational database from Couchbase, Inc. that supports data querying, full-text searching, and active global replication. Couchbase Server suffers from a security vulnerability that originates from internal users @cbq-engine-cbauth and...