5612 matches found
CVE-2018-13071
The mintToken function of a smart contract implementation for CCindex10 T10, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...
CVE-2017-14451
An exploitable out-of-bounds read vulnerability exists in libevm Ethereum Virtual Machine of CPP-Ethereum. A specially crafted smart contract code can cause an out-of-bounds read which can subsequently trigger an out-of-bounds write resulting in remote code execution. An attacker can create/send...
CVE-2016-15011
A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function checkSignResponse of the file dssp-client/src/main/java/be/econtract/dssp/client/SignResponseVerifier.java. The manipulation leads to xml external entity reference...
Dynamic Spectrum Sharing Based on the Rentable NFT Standard ERC4907
Centralized Dynamic Spectrum Sharing DSS faces challenges like data security, high management costs, and limited scalability. To address these issues, a blockchain-based DSS scheme has been proposed in this paper. First, we utilize the ERC4907 standard to mint Non-Fungible Spectrum Tokens NFSTs...
DeFeed: Secure Decentralized Cross-Contract Data Feed in Web 3.0 for Connected Autonomous Vehicles
Smart contracts have been a topic of interest in blockchain research and are a key enabling technology for Connected Autonomous Vehicles CAVs in the era of Web 3.0. These contracts enable trustless interactions without the need for intermediaries, as they operate based on predefined rules encoded...
Insufficient Control Flow Management
Overview vyper is a Pythonic Smart Contract Language for the EVM. Affected versions of this package are vulnerable to Insufficient Control Flow Management through the slice function. An attacker can bypass the evaluation of side effects in the start argument when the length argument is set to 0,...
CVE-2025-2306 Improper Access Control vulnerability in LIVE CONTRACT
An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents without authentication, if the URL is known. The attack requires the attacker to know the documents UUIDv4...
DMind Benchmark: toward a Holistic Assessment of LLM Capabilities across the Web3 Domain
Large Language Models LLMs have achieved impressive performance in diverse natural language processing tasks, but specialized domains such as Web3 present new challenges and require more tailored evaluation. Despite the significant user base and capital flows in Web3, encompassing smart contracts...
SYNCPILOT LIVE CONTRACT 访问控制错误漏洞
SYNCPILOT LIVE CONTRACT is a real-time contract program from SYNCPILOT Germany. A security vulnerability exists in SYNCPILOT LIVE CONTRACT that stems from improper access control of the file download feature, which could result in an unauthenticated user downloading sensitive documents...
SYNCPILOT LIVE CONTRACT 输入验证错误漏洞
SYNCPILOT LIVE CONTRACT is a real-time contract program from SYNCPILOT Germany. A security vulnerability exists in SYNCPILOT LIVE CONTRACT that stems from a path traversal vulnerability in the file download function, which could result in an unauthenticated user downloading an arbitrary file...
CVE-2025-46834 Alchemy's Modular Account can use executeUserOp to bypass allowlist prevalidation hook
Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249afcaeaf76ab95517d0359fde883b0, owners of Modular Accounts can grant session keys scoped external keys to external parties and would use the...
MAL-2025-3776 Malicious code in wwemix-contract (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7daf26cbd85174b1078f76ef7384573ce289257c6f91bb68462f87d436d832d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in wwemix-contract (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7daf26cbd85174b1078f76ef7384573ce289257c6f91bb68462f87d436d832d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Implementation and Security Analysis of Cryptocurrencies Based on Ethereum
Blockchain technology has set off a wave of decentralization in the world since its birth. The trust system constructed by blockchain technology based on cryptography algorithm and computing power provides a practical and powerful solution to solve the trust problem in human society. In order to...
ICE Is Paying Palantir $30 Million to Build ‘ImmigrationOS’ Surveillance Platform
In a document published Thursday, ICE explained the functions that it expects Palantir to include in a prototype of a new program to give the agency “near real-time” data about people self-deporting...
Malicious Code Detection in Smart Contracts Via Opcode Vectorization
With the booming development of blockchain technology, smart contracts have been widely used in finance, supply chain, Internet of things and other fields in recent years. However, the security problems of smart contracts become increasingly prominent. Security events caused by smart contracts...
‘Stupid and Dangerous’: CISA Funding Chaos Threatens Essential Cybersecurity Program
The CVE Program is the primary way software vulnerabilities are tracked. Its long-term future remains in limbo even after a last-minute renewal of the US government contract that funds it...
CVE Program Almost Unfunded
Mitre's CVE's program--which provides common naming and other informational resources about cybersecurity vulnerabilities--was about to be cancelled, as the US Department of Homeland Security failed to renew the contact. It was funded for eleven more months at the last minute. This is a big deal...
OpDiffer: LLM-Assisted Opcode-Level Differential Testing of Ethereum Virtual Machine
As Ethereum continues to thrive, the Ethereum Virtual Machine EVM has become the cornerstone powering tens of millions of active smart contracts. Intuitively, security issues in EVMs could lead to inconsistent behaviors among smart contracts or even denial-of-service of the entire blockchain...
