CVE-2022-41530

Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /saccoshield/ajax.php?action=deleteborrower...

PT-2022-25917 · Unknown · Open Source Sacco Management System

Name of the Vulnerable Software and Affected Versions: Open Source SACCO Management System version 1.0 Description: A SQL injection issue was found in the Open Source SACCO Management System. The vulnerability can be exploited via the id parameter at the "/sacco shield/ajax.php?action=delete...

Open Source SACCO Management System SQL注入漏洞

Open Source SACCO Management System is an open source SACCO management system by Mayuri K., a personal developer. A security vulnerability exists in version 1.0 of the Open Source SACCO Management System, which stems from an SQL injection issue in the id parameter of the...

maxLTV == 0 shouldn't be solvent but currently always solvent, so borrower can borrow all assets without any collateral.

Lines of code Vulnerability details Impact maxLTV == 0 shouldn't be solvent but currently always solvent, so borrower can borrow all assets without any collateral since isSolvent always return true. Proof of Concept Assume maxLTV == 0 User call borrowAsset /// @notice The borrowAsset function is...

Approved Borrower can can walk away with collateral in leveraged borrowed Position

Lines of code Vulnerability details Impact When an approved borrower calls leveragedPosition , their userBorrowShares and userCollateralBalance values are updated. The borrow will be able to walk away with collateral balance by adding more collateral to pass the isSolvent check and remove all the...

BORROWER CAN BORROW ASSET FROM HIMSELF AND GET THE SHARES

Lines of code Vulnerability details Impact User can borrow the asset from lender which the lender is himself. The user will get the share after he lend his asset to himself. Proof of Concept First the user, let say Alice, will call borrowAsset and set the address of the receiver to msg.sender...

If maxLTV == 0 case is used for allowing unlimited borrowing without any collateral, borrower whitelist must be enforced.

Lines of code Vulnerability details Impact If maxLTV == 0 case is used for allowing unlimited borrowing without any collateral, borrower whitelist must be enforced since it is a kind of undercollateral. Proof of Concept function isSolventaddress borrower, uint256 exchangeRate internal view return...

Lender can unconditionally liquidate borrower by changing oracle

Lines of code Vulnerability details Impact In NFTPairWithOracle.updateLoanParams, a lender is allowed change the oracle. If the lender set it some oracle that return invalid price, he can call removeCollateral immediately to liquidate the borrower. Proof of Concept function updateLoanParamsuint25...

Borrower can update loan parameters and force lender into accepting near-unliquidatable loan

Lines of code Vulnerability details Impact While loan is in LOANREQUESTED phase, the updateLoanParameters function can be called by the borrower to adjust TokenLoanParams.ltvBPS to a value that is very unfavorable for a prospective lender. Usually, this results in the loan not being accepted by a...

Lender can immediately liquidate valued Collateral in NFTPairWithOracle contract

Lines of code Vulnerability details Impact A lender can liquidate a borrower's collateral immediately by calling updateLoanParams in the NFTPairWithOracle contract where the ltvBPS for the params struct is set to 0. This bypasses the checks to make sure that the terms are favourable to the...

Borrower can frontrun lender's call to lend to increase ltvBPS and avoid liquidation

Lines of code Vulnerability details Impact In NFTPairWithOracle.lend, the loan ltvBPS can be higher than the lender's accepted ltvBPS. This allow a borrower to watch the mempool and front-run the lender's call and change ltvBPS to some very large value using updateLoanParams to avoid liquidation...

Possible to steal collateral during a reentrant collateral transfer

Lines of code Vulnerability details Impact In NFTPair.sol218 an ERC-721 transfer occurs. Anyone who gains execution during this transfer after the owner of the token is changed can steal the token transferred. Note that it will be applicable only if !skim. Since the exploit makes assumptions abou...

Blocking of Legitimate Liquidation

Lines of code Vulnerability details Issue: removeCollateral calculates whether liquidation is allowed via requirerate.mulloanParams.ltvBPS / BPS amount, "NFT is still valued";. An arbitrarily high ltvBPS will effectively bypass the oracle price and block liquidation. Consequences: A malicious...

Lender can unconditionally liquidate borrower by changing ltvBPS to 0

Lines of code Vulnerability details Impact In NFTPairWithOracle.updateLoanParams, a lender is allowed to decrease ltvBPS. If the lender set it to 0, he can call removeCollateral immediately to liquidate the borrower. Proof of Concept function updateLoanParamsuint256 tokenId, TokenLoanParams memor...

Moral hazard of borrower calling liquidate() and potential Oracle manipulation

Lines of code Vulnerability details Impact In the InceptionVaultsCore contract, the liquidate and liquidatePartial function can be called anyone. This means that the borrower for a specific vaultId can call liquidate or liquidatePartial on his own vault. Furthermore, the project incentivizes...

Malicious owner can steal some funds from borrower

Lines of code Vulnerability details Impact Owner can make changes to the protocol with immediate effect. Malicious owner can watch for big lend in the mempool and front run it by maxing out originationFeeRate to 5%. The users, both lender and borrower, will still think that originationFeeRate is...

Might not get desired min loan amount if _originationFeeRate changes

Lines of code Vulnerability details Impact Admins can update the origination fee by calling updateOriginationFeeRate. Note that a borrower does not receive their minLoanAmount set in createLoan, they only receive 1 - originationFee minLoanAmount, see lend. Therefore, they need to precalculate the...

Lack of Limit on amount Allows Borrowers To Be Extorted For Interest Payments

Lines of code Vulnerability details Impact There is on limit on the upper bounds on the amount a lender may send to a borrower. Borrowers will then be forced to pay interest and facilitators fee on the full amount loaned. The impact for a borrower is that they may be forced to repay significantly...

Bad Incentives For Lenders Who Buy Out Other Lenders

Lines of code Vulnerability details Impact Lenders are allowed to "buy out" another lender on a position via the loan function. This is supposed to be a purely positive sum action for the borrower, as the new lender must provide "better" terms than their predecessor, as checked here: However, in...

Borrower collateral can be stolen

Lines of code Vulnerability details Impact In case of collateral price fluctuation, lender can create a situation where borrower would be unable to repay the loan and lender could get hold of collateral Proof of Concept 1. User creates a loan request for duration 1 day and minimum amount as 0.1...