Malicious code in hardhat-contract-deploy (npm)

The package hardhat-contract-deploy was found to contain malicious code...

MAL-2025-26886 Malicious code in multisender-smart-contract (npm)

The package multisender-smart-contract was found to contain malicious code...

MAL-2025-16227 Malicious code in bsa-contract (npm)

The package bsa-contract was found to contain malicious code...

Qiyuesuo Eelectronic Signature Platform 代码问题漏洞

Qiyuesuo Eelectronic Signature Platform is an e-signature and e-contract management platform from China Contract Lock Qiyuesuo. A code issue vulnerability exists in Qiyuesuo Eelectronic Signature Platform version 4.34 and earlier, which stems from improper handling of the parameter File in...

SUSE CVE-2020-26241

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy at 0x00...04 contract di...

Exploit for CVE-2025-4126

POC-CVE-2025-4126 smart contract reentrancy attack vulnerabili...

DoS Attacks and Defense Technologies in Blockchain Systems: a Hierarchical Analysis

Blockchain technology is widely used in various fields due to its ability to provide decentralization and trustless security. This is a fundamental understanding held by many advocates, but it is misunderstood, leading participants to fail to recognize the limitations of the security that...

SAEL: Leveraging Large Language Models with Adaptive Mixture-Of-Experts for Smart Contract Vulnerability Detection

With the increasing security issues in blockchain, smart contract vulnerability detection has become a research focus. Existing vulnerability detection methods have their limitations: 1 Static analysis methods struggle with complex scenarios. 2 Methods based on specialized pre-trained models...

CVE-2025-54429 Polkadot Frontier's constructing smart contract can bypass precompile address bounding

Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled contracts, smart contracts, and externally owned accounts. Some EVM mechanisms should be unreachable by certain types of accounts for...

PT-2025-31154 · Polkadot · Polkadot Frontier

Name of the Vulnerable Software and Affected Versions: Polkadot Frontier versions prior to 0822030 Description: Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The implementation of CallableByContract incorrectly identified contract addresses running under...

GHSA-RM83-PXJX-PR5J Duplicate Advisory: CosmWasm affected by arithmetic overflows

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8724-5xmm-w5xq. This link is maintained to preserve external references. Original Description The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations...

CVE-2024-58263

The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations...

CVE-2024-58263

The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations...

CVE-2024-58263

The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations...

CVE-2024-58263

The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations...

CVE-2024-58263

CVE-2024-58263 concerns the cosmwasm-std crate prior to version 2.0.2 for Rust, which allows integer overflows that can lead to incorrect contract calculations. The vulnerability stems from wrapping arithmetic used in core operations, potentially causing miscalculations in smart contracts that re...

CVE-2025-54070

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length...

@oasisprotocol/sapphire-contracts (0.2.17), @originalworks/protocol-core-contracts (>=0.0.4, <=0.0.8) +14 more potentially affected by CVE-2025-54070 via @openzeppelin/contracts-upgradeable (>=5.2.0, <=5.3.0)

@openzeppelin/contracts-upgradeable NPM version =5.2.0, =0.0.4, =1.0.0, =0.1.0, =0.4.27, =0.3.0, =0.5.3, =7.9.0-maine3c28f1, =3.0.0-rc.0, =1.0.0-alpha.1, =0.3.0, =0.3.0, =0.3.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-54070 Source advisory: OSV:GHSA-9RCW-C2F9-2J55...

@1inch/delegating (2.0.0), @1inch/farming (4.0.0) +32 more potentially affected by CVE-2025-54070 via @openzeppelin/contracts (>=5.2.0, <=5.3.0)

@openzeppelin/contracts NPM version =5.2.0, =1.0.0-alpha.9, =0.0.4, =1.0.0, =0.1.0, =0.4.27, =0.3.0, =0.5.3, =7.9.0-main3c5a2f8, =7.9.0-maine3c28f1, =7.9.0-main01f77d70, =7.9.0-mainc91b9b3, =7.9.0-main163e291, =8.0.9 and more Source cves: CVE-2025-54070 Source advisory: OSV:GHSA-9RCW-C2F9-2J55...

CVE-2025-54070

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the lastIndexOfbytes,byte,uint256 function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1 the provided buffer length...