CWA-2023-004: Excessive number of function parameters in compiled Wasm

A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract. This can lead to high memory usage, slowdowns, potentially a crash and can poison a lock in the VM, preventing any further interaction with contracts. For more information, see...

PT-2024-40919 · Cosmwasm · Cosmwasm

Name of the Vulnerable Software and Affected Versions: CosmWasm affected versions not specified Description: A specifically crafted Wasm file can cause the VM to consume excessive amounts of memory when compiling a contract, leading to high memory usage, slowdowns, potentially a crash, and can...

Improper Validation Of Non-deterministic Behavior

github.com/cosmwasm/wasmd is vulnerable to Improper validation of non-deterministic behavior. The vulnerability is due to the incorrect marking of the SmartContractState query as safe, which may cause non-deterministic outcomes across different nodes. Attackers can potentially exploit this...

GO-2022-0970 elrond-go MultiESDTNFTTransfer call on a SC address with missing function name in github.com/ElrondNetwork/elrond-go

elrond-go MultiESDTNFTTransfer call on a SC address with missing function name in github.com/ElrondNetwork/elrond-go...

GO-2022-0829 Cronos vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos

Cronos vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos...

GO-2022-0760 Ethermint vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos

Ethermint vulnerable to DoS through unintended Contract Selfdestruct in github.com/crypto-org-chain/cronos...

cosmwasm-check (>=1.1.0-rc.1, <=1.3.4), cw-check-contract (1.0.1) +4 more potentially affected by unknown CVE via cosmwasm-vm (>=1.2.8, <=1.3.4)

cosmwasm-vm CARGO version =1.2.8, =1.1.0-rc.1, =0.5.3-2, =0.6.0-beta1, =0.17.1 Source cves: unknown CVE Source advisory: OSV:GHSA-RG2Q-2JH9-447Q...

Nexera DeFi Protocol Hacked: $1.8M Stolen in Major Smart Contract Exploit

Learn how a smart contract vulnerability led to the theft of $1.8 million from Nexera, a DeFi protocol.…...

GHSA-Q6HG-6M9X-5G9C Evmos vulnerable to exploit of smart contract account and vesting

Summary This advisory board aims to describe two vulnerabilities found in the Evmos codebase: - Authorization check on the fundVestingAccount: unauthorized spend of funds. Details Authorization check on the fundVestingAccount With the current implementation, a user can create a vesting account wi...

GO-2024-2974 Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos

Evmos vulnerable to exploit of smart contract account and vesting in github.com/evmos/evmos...

CVE-2024-39696 Evmos vulnerable to exploit of smart contract account and vesting

Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account EOA or contract as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization...

CVE-2024-39696 Evmos vulnerable to exploit of smart contract account and vesting

Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account EOA or contract as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization...

MAL-2024-1675 Malicious code in near-linkdrop-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ff40b77a91a8e45cd8e9541c0872d1e97a5e365768e2e6f34550d24f8c02fa0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in near-linkdrop-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ff40b77a91a8e45cd8e9541c0872d1e97a5e365768e2e6f34550d24f8c02fa0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-2032 Malicious code in crowdfund-contract (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in crowdfund-contract (npm)

--- -= Per source details. Do not edit below this line.=-...

Rootstock Labs: Crafted smart contract can take ~23 seconds to execute due to immense error string construction

The crafted smart contract can take approximately 23 seconds to execute due to the immense error string construction. The vulnerability was caused by the native contract's implementation, which constructed the entirety of the input message as a hex string for logging and throwing an exception. Th...

GO-2024-2903 Contract balance not updating correctly after interchain transaction in github.com/evmos/evmos

Contract balance not updating correctly after interchain transaction in github.com/evmos/evmos...

Session Fixation

Evmos is vulnerable to Session Fixation. The vulnerability is due to the improper handling of contract balances during interchain transactions involving a local state change and an ICS20 transfer. An attacker can exploit this flaw to artificially increase the supply of Evmos tokens by manipulatin...

bind, bind-dyndb-ldap, and dhcp security update

bind 32:9.11.4-26.P2.16 - Prevent increased CPU consumption in DNSSEC validator CVE-2023-50387 CVE-2023-50868 - Add missing design by contract tests to dnscatz - Speed up parsing of DNS messages with many different names CVE-2023-4408 - Do not use headerprev in expirelruheaders bind-dyndb-ldap...