users can mint TT tokens without locking/depositing any currency tokens

Lines of code https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.solL427-L441...

There is no concept of a requestDeposit, requestRedeem receipt made on the source chain, resulting in no recovery proces escrowed funds in the event of bridge or Centrifuge fall.

Lines of code Vulnerability details Impact There is no kind of request receipt on the EVM chain at all. The InvenstmentManagerrequestDeposit simply puts users tokens in the escrow and then the request gets routed to the Gateway and later to the outgoingRouter. The flow goes as follows 1.Buyer cal...

possibility of reentrancy attack when poolManger.sol#Transfer called with malicious recipient contract address

Lines of code Vulnerability details Impact when users calls the transfer function in the poolManger.sol the transaction data will be send to the centrifuge chain first and then it will be back to the router and then direct it to thehandleTransfer function in poolManger.sol, user can make a...

previewWithdraw doesn't round up the asset amount leading to confusion when external protocols integrate with the vaults of the protocol

Lines of code Vulnerability details Impact Protocols, that integrate with Centrifuge liquidity pools may wrongly assume that withdraw rounds the amount up as per the ERC-4626 specification leading to a wide array or issues for both parties. Proof of Concept The following is stated in the EIP's...

Malicious code in centrifuge-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b63f2df39cf6522468345009bc1e3efe074e6f0985e6b714ed34125ffb609aa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Stuxnet's First Five Victims Provided Path to Natanz

Stuxnet’s first five victims were a carefully crafted list of targets that ultimately provided the attackers with the road map they needed to get inside a uranium enrichment plant in Natanz, Iran and disrupt the country’s nuclear program. Cobbled together from clues left behind by the infamous...

Stuxnet Had Older, More Complex Variant

Stuxnet was a two-headed beast as it turns out, one that could have laid waste to the Natanz nuclear facility which it infected, and one that should have, by expert accounts, remained undetected if not for the noisier yet less complex second attack routine that is now familiar to the world...

CentrifugeSystems Denial Of Service

Automated Looping in Apache/JSP AND CentrifugeSystems Exploit Title: Automated Looping in CentrifugeSystems Date: 14-Jan-10 Author: Asheesh Kumar Mani Tripathi Software Link: www.centrifugesystems.com Description :Exceptional Conditional Error This Type of Vulnerability is found mainly in apache...