LinearBondingCurve.log2 function contains an incorrect shift operation that could lead to wrong calculation.

Lines of code Vulnerability details Impact The values in the shift operation are reversed. The provided inline assembly code for the log2 function appears to be an issue in the sequence of shift operations. Let's break down the relevant part of the code: r := or r, byte and0x1f, shrshrr, x,...

The deposited amount is included in how rsEthAmountToMint is calculated and it should not. Second depositors get less rsETH shares than deserved.

Lines of code Vulnerability details Impact All deposits, starting with the second one, incur a loss in the received rsETH amount. Proof of Concept LRTDepositPool::depositAsset helps users to stake LST in exchange for rsETH shares. First the LST is transferedFrom user to depositPool and rsETH is...

stETH/ETH, rETH/ETH and cbETH/ETH chainlink oracles has too long of heartbeat and deviation threshold which can cause loss of funds

Lines of code Vulnerability details ChainlinkPriceOracle fetches prices from the Chainlink contracts. But the price feeds in the consideration has a very long price heartbeat and deviation rate which might lead to wrong price calculation and loss of token to the user. Impact According to the...

Biased rsETH price calculation in depositAsset results in lesser rsETH minted to user

Lines of code Vulnerability details Impact The LRTDepositPool acts as a simplified vault allowing restakers to transfer their liquid staked tokens and receive rsETH tokens based on the current rsETH exchange rate. rsETH are minted to user by interacting with depositAsset function of LRTDepositPoo...

Mint amount calculation in deposit is incorrect

Lines of code Vulnerability details Summary The calculation in the deposit function of the DepositPool contract is flawed as it factors the deposited amount into the RSETH price to calculate the amount to mint. Impact When a user deposits in the DepositPool contract, the amount of RSETH to mint i...

rsETH can return incorrect price because of future EigenLayer strategies

Lines of code Vulnerability details Impact How currently rsETH price is calculated? totalEthLocked is divided by rsETH supply. How totalEthLocked is calculated? It sums 3 amounts per every asset: 1 balance of LRTDepositPool.sol, 2 balance of all node delegators, 3 already deposited amount of asse...

mint with sales option 3 doesn't work as expected

Lines of code Vulnerability details Summary lastMintDatecol is set to be higher than expected, which can lead to the minting process being blocked for some time. Vulnerability Details In the mint function in the MintContract if the salesOption of the collection is set to 3 then we can only mint 1...

FreeBSD : libsndfile_project -- Integer overflow in dataend calculation (4ade0c4d-7e83-11ee-9a8c-00155d01f201)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 4ade0c4d-7e83-11ee-9a8c-00155d01f201 advisory. - Multiple signed integers overflow in function aureadheader in src/au.c and in functions mat4open and...

RHEL 7 : xorg-x11-server (RHSA-2023:6802)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:6802 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user...

kernel: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation

In the Linux kernel, the following vulnerability has been resolved: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation In function rt6nlmsgsize, the length of nexthop is calculated by multipling the nexthop length of fib6info and the number of siblings. However if the fib6info h...

Fedora 39 : xorg-x11-server-Xwayland (2023-2eb445d52b)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2eb445d52b advisory. Xwayland 23.2.2 ---- Security fix for CVE-2023-5367 Tenable has extracted the preceding description block directly from the Fedora security advisory...

SocializeLoss can revert in underflow

Lines of code Vulnerability details Impact SocializeLoss can revert in underflow so the admin cannot socalize loss properly Proof of Concept SocializeLoss can revert in underflow so the admin cannot socalize loss properly In the current implementation of the socialize loss uint256 amount =...

Users pay higher fee than intended

Lines of code Vulnerability details Impact Protocol mints incorrect depositAmount and depositShare to protocol. Such that reserveFee is higher than defined. Suppose following scenario: 1. Tranche 2 has 20% APR, has 5000 borrowed 2. Tranche 1 has 10% APR, has 10000 borrowed 3. ReserveFee is 10% 4...

Upgraded Q -> 2 from #430 [1699028562977]

Judge has assessed an item in Issue 430 as 2 risk. The relevant finding follows: It’s not clear which token the OD token will be paired with in order to determine the price in the uniV3Relayer contract. Then the following lines are problematic: baseAmount = uint12810...

The _transferToBeneficiary() incorrectly assumes Native ETH amount and ERC20 Token amount as 1:1.

Lines of code Vulnerability details Impact The transferToBeneficiary function of EthenaMinting.sol incorrectly assumes Native ETH amount and ERC20 Token amount as 1:1. Proof of Concept The transferToBeneficiary function is used in redeem function of EthenaMinting.sol. Though, you are not allowed ...

Vesting amount is calculated incorrectly in StakedUSDe contract

Lines of code Vulnerability details Description The description says vestingAmount is the contract balance + any unvested remainder at that time but it is set incorrectly in the code. /// @notice The amount of the last asset distribution from the controller contract into this /// contract + any...

stellar-strkey vulnerable to panic in SignedPayload::from_payload

Impact Panic vulnerability when a specially crafted payload is used. This is because of the following calculation: rust innerpayloadlen + 4 - innerpayloadlen % 4 % 4 If innerpayloadlen is 0xffffffff, 4 - innerpayloadlen % 4 % 4 = 1 so rust innerpayloadlen + 4 - innerpayloadlen % 4 % 4 = u32::MAX ...

Function _joinCollateral calculates variable wei incorrectly for collateral tokens that do not have 1e18 decimals

Lines of code Vulnerability details Impact Collateral tokens with decimals other than 1e18 will not work. Proof of Concept Function joinCollateral in CommonActions.sol, which is inherited by BasicActions.sol in scope calculates the collateral token amount wrongly for all non 1e18 decimal tokens...

xorg-server -- Multiple vulnerabilities

The X.Org project reports: ZDI-CAN-22153/CVE-2023-5367: X.Org server: OOB write in XIChangeDeviceProperty/RRChangeOutputProperty When prepending values to an existing property an invalid offset calculation causes the existing values to be appended at the wrong offset. The resulting memcpy would...

[ADRIRO-NEW-H-02] Users loses their share of rewards while waiting for withdrawal

Lines of code Vulnerability details Summary Withdrawals in AfEth undergo a delay until the underlying CVX tokens can be withdrawn. Depositors need to request a withdrawal and wait until the required withdrawal epoch before making their withdrawal effective. During this period of time, they will...