Malicious code in axelar-presets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a0ba6bc89d6d2aad9c955f0057c3c7085448df4c3e5972e6253b3c13cbc946d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1065 Malicious code in axelar-presets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a0ba6bc89d6d2aad9c955f0057c3c7085448df4c3e5972e6253b3c13cbc946d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in immutable-axelar-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d36818770ca9a97d6b714a041348e2e44a341e8d2f017aff4fb1dc912d185e41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10560 Malicious code in immutable-axelar-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d36818770ca9a97d6b714a041348e2e44a341e8d2f017aff4fb1dc912d185e41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The current axelar router's implementation can't interact with any calls that requires native tokens

Lines of code Vulnerability details Impact Medium... this completely blocks off users that would need to call a contract and want to pass value to them, as they can't do this since the functions are not payable Proof of Concept See summary Additionally take a look at the Axelar's Router.sol and s...

Unsafe message encode and decode for cross chain message transfer and in execution process through axelar

Lines of code Vulnerability details Impact The cross chain message passing is done through the axelar gateway contracts. To pass the message, the message has to be formatted abi.encode and sent to destination chain from source chain. In destination chain, through gateway contract, the received...

No gas payment is done before calling the callContract in the Router.sol

Lines of code Vulnerability details Impact In the Axelar documentation it is specified that before calling callContract or callContractWithToken the user needs to first prepay the relayers gas fee on the source chain, but since the functions are not payable, nor does call...

Maybe you get the same txnHash for different transactions in DestinationBridge._execute()

Lines of code Vulnerability details Impact DestinationBridge.execute is a function that is executed when contract is called by Axelar Gateway -L114. The function calculates bytes32 txnHash = keccak256payload. txnHash is calculated based on payload. However, srcChain is not taken into account in...

Lack of an option in DestinationBridge.sol to cancel a transaction can lead to unwanted transactions

Lines of code Vulnerability details Impact DestinationBridge.sol is for handling calls from Axelar Gateway and must be deployed in the destination chain. DestinationBridge.sol requires that the address from which Axelar messages are sent must be registered in the recipient's contract. Once a...

Users can lost their USDY tokens in the Source Chain if something fails during the crosschain communication because there is not a validation mechanism to confirm that tokens were minted in the Destination Chain

Lines of code Vulnerability details Impact Users can lost their USDY tokens that were burnt in the Source Chain when bridging to another chain. Proof of Concept The bridging implementation solely relies and assumes that all messages sent to the Axelar Network will be validated and won't have any...

MID-Risk Vulnerabilities in the Axelar Smart Contracts

Lines of code Vulnerability details Impact The vulnerabilities that I have identified could have a significant impact on the Axelar network. These vulnerabilities could be exploited by an attacker to: Gain control of the Axelar network by proposing and voting on malicious proposals. Mint or burn...

MID-Risk Vulnerabilities in the Axelar Smart Contracts

Lines of code s://github.com/code-423n4/2023-07-axelar/tree/main/contracts/cgp/governance/AxelarServiceGovernance.solL73 Vulnerability details Impact The vulnerabilities that I have identified could have a significant impact on the Axelar network. These vulnerabilities could be exploited by an...

Did Not Approve To Zero First

Lines of code Vulnerability details Some ERC20 tokens like USDT do not work when changing the allowance from an existing non-zero allowance value. For example Tether USDT's approve function will revert if the current approval is not zero, to protect against front-running changes of approvals. The...

Malicious code in axelar-signing-relayer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1e055dcb45cb56b60eef5249acdc3ed71a7eea55bf8e7e10ca3875941f005b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1206 Malicious code in axelar-signing-relayer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1e055dcb45cb56b60eef5249acdc3ed71a7eea55bf8e7e10ca3875941f005b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-chain smart contract calls can revert but source chain tokens remain burnt and are not refunded

Lines of code Vulnerability details Impact Smart contract calls often revert. In such cases any ether sent along with the transaction is returned and sometimes the remaining gas depending on whether an assert caused the reversion or not. For contracts involving ERC20 tokens it is also expected...