GHSA-XH2P-7P87-FHGH Incorrect TCR calculation in batchLiquidateTroves() during Recovery Mode

TCR is temporarily miscalculated in the batchLiquidateTroves function during Recovery Mode. The bug lies in batchLiquidateTroves of TroveManager. When calculating system's entire collateral, we should also exclude the liquidated trove's surplus collateral, since liquidation closes the trove and...

Users can avoid paying borrowing interest after the fyToken matures

Handle shw Vulnerability details Impact According to the protocol design, users have to pay borrowing interest when repaying the debt with underlying tokens after maturity. However, a user can give his vault to Witch and then buy all his collateral using underlying tokens to avoid paying the...

Uninitialized or Incorrectly set auctionInterval may lead to liquidation engine livelock

Handle 0xRajeev Vulnerability details Impact The grab function in Cauldron is used by the Witch or other liquidation engines to grab vaults that are under-collateralized. To prevent re-grabbing without sufficient time for auctioning collateral/debt, the logic uses an auctionInterval threshold to...

Wrong calcAsymmetricShare calculation

Handle @cmichelio Vulnerability details Vulnerability Details The inline-comment defines the number of asymmetric shares as u U 2 A^2 - 2 U u + U^2/U^3 but the Utils.calcAsymmetricShare function computes uA 2U^2 - 2uU + u^2 / U^3 which is not equivalent as can be seen from the A^2 term in the fir...

Incorrect AsymmetricShare calculation in Utils.sol

Handle 0xRajeev Vulnerability details Impact The calcAsymmetricShare function is supposed to calculate the numerator as: share = u U 2 A^2 - 2 U u + U^2/U^3 which can be considered as part1 part2 - part3 + part4 / part5 according to the code comments. However the formula for part1, part2 and part...

Swap value can be manipulated allowing under-collateralized loans

Handle @cmichelio Vulnerability details Vulnerability Details When borrowing with synths as collateral the synth collateral value in base tokens is computed as baseValue = calcSwapValueInBaseiSYNTHcollateralAsset.TOKEN, collateralAdjusted;, i.e., the result of a trade of the underlying token to...

Potential huge arbitrage opportunities / MPL price decrease

Handle @cmichelio Vulnerability details Vulnerability Details When the protocol suffers a default, the BPT stakers are the first line of defence and the protocol trades the BPT pool tokens for the single-sided liquidity asset of the Balancer LIQUIDITY MPT pool. PoolLib.handleDefault Note that a...

Loans of tokens with >18 decimals can result in incorrect collateral calculation

Handle 0xsomeone Vulnerability details Impact It is possible for a user to mislead a Pool Delegate to a seemingly innocuous loan by utilizing a token with more than 18 decimals as collateral and lucrative loan terms. Proof of Concept The final calculation within the collateralRequiredForDrawdown ...

BlockDev Sp. Z o.o: Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick`

Summary: The flap contract provides the ability to auction DAI for MKR. That's a fundamental functionality of the MCD system, invoked usually from the vow contract. A flaw in the validation of calls to flap.kick, however, allows a malicious user to create "fake' auctions that can be later used to...

BlockDev Sp. Z o.o: Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`

Summary: The flip contract allows for the MCD system to auction collateral in exchange for DAI. A lack of validation in the method flip.kick allows an attacker to create an auction with a fake bid value. Since the end contract trusts that value, it can be exploited to issue any amount of free DAI...

BlockDev Sp. Z o.o: Steal collateral during `end` process, by earning DSR interest after `flow`.

Summary: The end contract in MCD controls the process of shutting down the MCD contracts and allowing for users to redeem their DAI for collateral -- presumably to migrate to a new implementation of DAI. The process, however, doesn't prevent the continued functioniong of DAI savings accounts pot...

BSides SF 2019: Remote-Root Bug in Logitech Harmony Hub Patched and Explained

SAN FRANCISCO – Users of Logitech’s Harmony Hub have been wide open to an attack for years because of four unpatched vulnerabilities that left any IoT device connected at risk to remote takeover. The bugs were patched by Logitech in November, but for the first time the researchers that discovered...

China Chip Hack Shines Spotlight on Hardware and Supply-Chain Risk

Recent revelations in the press regarding hardware implants and supply-chain compromise are troubling and should be seen as an opportunity to assess our current threat model and security approach. This recently revealed situation is the hardware analogue to the software supply chain compromises w...

China Chip Hack Shines Spotlight on Hardware and Supply-Chain Risk

Recent revelations in the press regarding hardware implants and supply-chain compromise are troubling and should be seen as an opportunity to assess our current threat model and security approach. This recently revealed situation is the hardware analogue to the software supply chain compromises w...

Oracle Financial Services Applications FLEXCUBE Enterprise Limits and Collateral Management component access control error vulnerability (CNVD-2019-39911)

Oracle Financial Services Applications is Oracle's suite of financial services software that combines core banking, online banking, and property management.Oracle FLEXCUBE Enterprise Limits and Collateral Oracle FLEXCUBE Enterprise Limits and Collateral Management is one of the components used to...

Oracle Financial Services Applications FLEXCUBE Enterprise Limits and Collateral Management component access control error vulnerability (CNVD-2019-39916)

Oracle Financial Services Applications is Oracle's suite of financial services software that combines core banking, online banking and property management. FLEXCUBE Enterprise Limits and Collateral Management is a component of FLEXCUBE that is used to manage real-time online exposure of products...

Oracle Financial Services Applications FLEXCUBE Enterprise Limits and Collateral Management component access control error vulnerability (CNVD-2019-39918)

Oracle Financial Services Applications is Oracle's suite of financial services software that combines core banking, online banking and property management. FLEXCUBE Enterprise Limits and Collateral Management is a component of FLEXCUBE that is used to manage real-time online exposure of products...

Oracle Financial Services Applications FLEXCUBE Enterprise Limits and Collateral Management component access control error vulnerability (CNVD-2019-39912)

Oracle Financial Services Applications is Oracle's suite of financial services software that combines core banking, online banking and property management. FLEXCUBE Enterprise Limits and Collateral Management is a component of FLEXCUBE that is used to manage real-time online exposure of products...

Oracle Financial Services Applications FLEXCUBE Enterprise Limits and Collateral Management component access control error vulnerability (CNVD-2019-39924)

Oracle Financial Services Applications is Oracle's suite of financial services software that combines core banking, online banking and property management. FLEXCUBE Enterprise Limits and Collateral Management is a component of FLEXCUBE that is used to manage real-time online exposure of products...

Oracle Financial Services Applications FLEXCUBE Enterprise Limits and Collateral Management component access control error vulnerability (CNVD-2019-39922)

Oracle Financial Services Applications is Oracle's suite of financial services software that combines core banking, online banking and property management. FLEXCUBE Enterprise Limits and Collateral Management is a component of FLEXCUBE that is used to manage real-time online exposure of products...