Rewards calculation does not consider GMX reward rate fluctuation

Lines of code Vulnerability details Impact The current time based px rewards calculation system is not accurate, and not fair for users. Due to GMX protocol reward rate fluctuation, px users stake and claim at different time could get less or more rewards they deserve. Some users could abuse the...

fee loss in AutoPxGmx and AutoPxGlp and reward loss in AutoPxGlp by calling PirexRewards.claim(pxGmx/pxGpl, AutoPx*) directly which transfers rewards to AutoPx* pool without compound logic get executed and fee calculation logic and pxGmx wouldn't be executed for those rewards

Lines of code Vulnerability details Impact Function compound in AutoPxGmx and AutoPxGlp contracts is for compounding pxGLP and additionally pxGMX rewards. it works by calling PirexGmx.claimpx, this to collect the rewards of the vault and then swap the received amount to calculate the reward,...

PT-2022-36791 · Git +1 · Libredwg

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue is identified, potentially causing a crash. The crash involves the functions bit calc CRC, decode preR13, and dwg decod...

Incorrect revenue calculation will lead to revenue theft through proxy attacks

Lines of code Vulnerability details Impact The incorrect way revenue is calculated can lead to CSR being stolen through proxy attacks, which is likely to lead the ecology into CSR bribery war. Eventually, this feature will translate into reduced gas fees for all transactions, regardless of whethe...

Medium: Users receive an incorrect account of their accumulated ETH in GiantMevAndFeesPool.

Lines of code Vulnerability details Description GiantMEVAndFeesPool exposes previewAccumulatedETH for users to view how much ETH they have accumulated through the vault: function previewAccumulatedETH address user, address calldata stakingFundsVaults, LPToken calldata lpTokens external view retur...

CVE-2022-41886: Incorrect Calculation of Buffer Size

TensorFlow is an open source platform for machine learning. When tf.rawops.ImageProjectiveTransformV2 is given a large output shape, it overflows. We have patched the issue in GitHub commit 8faa6ea692985dbe6ce10e1a3168e0bd60a723ba. The fix will be included in TensorFlow 2.11. We will also...

Variable claimed its being resetting instead of adding

Lines of code Vulnerability details Impact The variable claimed that keeps tracking of the total amount claimed per user per token its being being resetting with a wrong value. This impacts on the line due calculation on SyndicateRewardsProcessor.solL61 uint256 due = accumulatedETHPerLPShare...

GSD-2022-1006708 io_uring: fix fdinfo sqe offsets calculation

iouring: fix fdinfo sqe offsets calculation This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.3 by commit...

CVE-2022-31630: Incorrect Calculation of Buffer Size

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar function, the read outside allocated buffer will be used. This can lead to crashes or...

PT-2022-35475

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.150 Description The issue is related to the blk-throttle component, where an overflow can occur while calculating wait time. The actual impact and attack plausibility have not yet been proven. Recommendatio...

Overpayment of ETH is not refunded to the buyer

Lines of code Vulnerability details Impact Overpayment of ETH is not refunded to the buyer Proof of Concept ' function executeFundsTransfer address seller, address buyer, address paymentToken, Fee calldata fees, uint256 price internal if msg.sender == buyer && paymentToken == address0...

BLOCK_PERIOD is incorrect

Lines of code Vulnerability details The BLOCKPERIOD is set to 13 seconds in Config.sol. uint256 constant BLOCKPERIOD = 13 seconds; Since moving to Proof-of-Stake PoS after the Merge, block times on ethereum are fixed at 12 seconds per block slots. . Impact This results in incorrect calculation of...

Out-of-bounds

In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an attacker who has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitatio...

Some bidders can withdraw would claim moreof the baseToken when auction CliffPercent value is 1

Lines of code Vulnerability details Impact If an auction is created with a.timings.cliffPercent set to 1 , then during withdrawal of baseTokens after auction ends, the some bidders to withdraw would claim more tokens than others of the baseToken amounts. Proof of Concept 1. Auction A is created...

Wrong bidIndex calculation

Lines of code Vulnerability details Impact Return wrong bidIndex Proof of Concept SizeSealed.sol Tools Used Manual Recommended Mitigation Steps uint256 bidIndex = a.bids.length - 1 ; --- The text was updated successfully, but these errors were encountered: 👎 1 trust1995 reacted with thumbs down...

PT-2022-21415 · Typec · Typec

Name of the Vulnerable Software and Affected Versions: typec affected versions not specified Description: The issue is related to an incorrect calculation of buffer size, which could lead to a possible out of bounds write. This might allow an attacker with physical access to the device to escalat...

Tenable Nessus < 8.15.3, 10.x < 10.1.1 Multiple Vulnerabilities (TNS-2022-05)

Tenable Nessus is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessus"; ifdescripti...

The decimal calculation is wrong for tokens with decimals < 18, it will highly inflate the price.

Lines of code Vulnerability details Impact The decimal calculation is wrong for tokens with decimals 18, it will highly inflate the price. Every function that uses oracle price such as borrow and liquidation will be wrong for tokens with decimals 18. Proof of Concept uint8 decimals = 36 -...

Using a non-18 decimals token as collateral (for ex. USDT) in a Market will result in multiple value losing situations

Lines of code Vulnerability details Proof of Concept In multiple places in the code, when doing calculations with both debt and price of collateral there is a multiplication by 1e18 - 1 ether. We have the following calculations: uint minimumCollateral = debt 1 ether /...

Liquidator is paid too much

Lines of code Vulnerability details Impact Liquidator is paid 1 + liquidationIncentive repaidDebt, instead of liquidationIncentive repaidDebt. Proof of Concept liquidatorReward is currently calculated in Market.liquidate as follows: uint liquidatorReward = repaidDebt 1 ether / price;...