Wrong decoding of paymaster data makes validatePaymasterUserOp always fail, DoS

Lines of code Vulnerability details Impact DoS of validatePaymasterUserOp makes UserOperation's with paymaster not executable Proof of Concept . decodePaymasterData on line 102 in VerifyingSingletonPaymaster.validatePaymasterUserOp returns wrong data and makes function always fail due to the...

buyQuote should be rounded up

Lines of code Vulnerability details Impact The buyQuote is not rounded up, which can cause a leak of value, due to the buyQuote being underestimated. Proof of Concept The function Pair.buyQuote does not round up, which can cause the issue described under Impact: function buyQuoteuint256...

Miners Can Re-Roll the VRF Output to Game the Protocol

Lines of code Vulnerability details Impact Miners are able to rewrite a chain's history if they dislike the VRF output used by the protocol. Consider the following example: A miner or well-funded user is participating in the PoolTogether protocol. A VRF request is made and fulfilled in the same...

Attacker can make anyone as allowedMsgSender

Lines of code Vulnerability details Impact The contract AllowedMsgSenders have a role allowedMsgSender, and the function to set that role is made public with no access control allowing the attacker to set anyone and escalate his privileges to that role Proof of Concept truffle console --networkId...

Buy can be executed after sale end

Lines of code Vulnerability details Impact In LPDA.sol buy function when all tokens are minted, the final price is set and the ether from the sale and fee is sent to the saleReceiver and feeReceiver addresses. Since there is no check to validate if sale has ended the function can be executed with...

Nonce is not updated after EVM Transaction

Lines of code Vulnerability details Impact It was observed that nonce is not updated while performing the EVM transaction. This could lead to Replay attacks Proof of Concept 1. Observe the CallEVM function func k Keeper CallEVM ctx sdk.Context, from common.Address, to common.Address, amount...

Unchecked transfer

Lines of code Vulnerability details Impact The return value of an external transfer/transferFrom call is not checked Proof of Concept you can check Vulnerability in code here: Tools Used Recommended Mitigation Steps Use SafeERC20, or ensure that the transfer/transferFrom return value is checked...

Users are unable to revoke consents

Lines of code Vulnerability details Impact Neither lenders nor borrowers can revoke mutualConsents. This can pose an issue if a lender has given consent to lend funds but a borrower has proven untrustworthy either through actions in another credit line or some other public way. A lender should be...

Cross-chain replay attacks are possible with create2()

Lines of code Vulnerability details Impact Mistakes made on one chain can be re-applied to a new chain There is no chain.id in the create2 function data If a user does create2 using the wrong network, an attacker can replay the action on the correct chain, and steal the funds a-la the wintermute...

reentrancyGuardInitializer modifier used on constructor and Initialize functions

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. In L1EthBridge.sol there are two places where the reentrancyGuardInitializer modifier is used. It's found on both the constructor function and also on the initialize function. This is a problem because...

StandardPolicyERC1155.sol returns amount == 1 instead of amount == order.amount

Lines of code Vulnerability details Impact The canMatchMakerAsk and canMatchMakerBid functions in StandardPolicyERC1155.sol will only return 1 as the amount instead of the order.amount value. This value is then used in the executeTokenTransfer call during the execution flow and leads to only 1...

EulerOS 2.0 SP10 : openssl (EulerOS-SA-2022-2432)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properl...

Lack of check for contract existance can cause loss of funds during transfers

Lines of code Vulnerability details Impact The current transfers will not check if the to address is for an existing token contract. This can cause loss of funds if an user attempts to make a swap for a tokens added to a pool and destructed later. Proof of Concept TokenA gets added to a pool The...

AlgebraPool.sol#L488 : onlyValidTicks modifier is missing for function

Lines of code Vulnerability details Impact Invalid ticks can be allowed for collection. Proof of Concept function collect address recipient, int24 bottomTick, int24 topTick, uint128 amount0Requested, uint128 amount1Requested external override lock returns uint128 amount0, uint128 amount1 Position...

AlgebraPool.sol#L501-L507 : position.fees are updated without checking whether the amount value is greater than zero or not

Lines of code Vulnerability details Impact Incorrect fee update if any one of the amount is zero. Proof of Concept if amount0 | amount1 != 0 position.fees0 = positionFees0 - amount0; position.fees1 = positionFees1 - amount1; if amount0 0 TransferHelper.safeTransfertoken0, recipient, amount0; if...

Missing payable

Lines of code Vulnerability details Impact The following functions are not payable but uses msg.value - therefore the function must be payable. This can lead to undesired behavior. Proof of Concept frxETHMinter.sol, submit should use payable since it uses msg.value Tools Used Manual review...

EulerOS Virtualization 2.9.0 : openssl (EulerOS-SA-2022-2396)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by...

Division Before Multiplication Can Lead To Zero

Lines of code Vulnerability details Impact There is a division before multiplication bug that exists in truncatedCurrentVestingDurationSecs calculations Proof of Concept uint40 truncatedCurrentVestingDurationSecs = currentVestingDurationSecs / claim.releaseIntervalSecs claim.releaseIntervalSecs;...

Missing ReEntrancy Guard to Withdraw function

Lines of code Vulnerability details Impact Missing ReEntrancy Guard to Withdraw function Proof of Concept There is no re-entry risk on true ERC-20 tokens that work according to the spec i.e. audited, etc.. However you can write a malicious ERC-20 with custom transferFrom or approve that have...

[NAZ-H2] withdraw() does not update allowances

Lines of code Vulnerability details Impact withdraw is meant for the owner or approved receiver to withdraw the owner's deposited assets and burn the owner's shares. Since it does this for all of the owner's shares, the approved receiver should not be approved for all anymore after burning. Proof...