Potential SHA256 Digest Vulnerability in Solidity Contract

Lines of code Vulnerability details Impact This vulnerability enables the hacker to pass malicious data to the "verify" function, which in turn uses the said data as input for the sha256 function, this can lead to unexpected or incorrect output, potentially resulting in unauthorized access to...

verifySignatureWithKey - RRSIG RR's Signer's Name is never checked if it matches owner name

Lines of code Vulnerability details Impact According to RFC 4035 and as mentioned in the comments in function "verifySignatureWithKey" , the Signer's name should also be checked if it matches the owner name. If the Signer's Name field of an RRSIG record does not match the owner name of a DNSKEY...

Timestamp manipulation affects DNSSEC records on contracts/dnssec-oracle/DNSSECImpl.sol

Lines of code Vulnerability details Impact timestamp parameter to validate DNSSEC records. The timestamp parameter is passed as an argument to the verifyRRSIG function, which is responsible for verifying that the DNSSEC record is valid at a specific point in time. If the timestamp parameter can b...

CVE-2023-30629

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...

Design/Logic Flaw

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...

CVE-2023-30629

CVE-2023-30629 affects the Vyper compiler (versions 0.3.1–0.3.7). When using built-in function raw_call with revert_on_failure=False and max_outsize=0 , the compiler generates incorrect bytecode, causing the returned value from the call to be an unreliable boolean (may be True or False) depending...

CVE-2023-30629 Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...

CVE-2023-30629 Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...

4337-snap (>=0.1.0, <=0.1.1), @0xabcdefg/smart-order-router (>=1.0.0, <=1.0.5) +1448 more potentially affected by CVE-2023-30542 via @openzeppelin/contracts (>=4.3.0, <=4.8.2)

@openzeppelin/contracts NPM version =4.3.0, =0.1.0, =1.0.0, =1.0.0, =3.24.7, =1.7.2, =0.107.10, =1.9.0, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2023-30542 Source advisory: OSV:GHSA-93HQ-5WGC-JC82...

POSITION LIMIT COULD BE FULLY REDUCED TO ZERO BY CLONES

Lines of code Vulnerability details Impact A newly opened position could have its limit fully reduced to zero as soon as the cooldown period has elapsed. Proof of Concept As seen in the function below, a newly opened position with 0 Frankencoin minted could have its limit turn 0 if the function...

function restructureCapTable() in Equity.sol not functioning as expected

Lines of code Vulnerability details Impact Incorrect typo in function restructureCapTable leading to only burning tokens of first address of addressToWipe array arguement. Proof of Concept Here, in L313, addressToWipe0 only takes first address of the array. While ignoring the rest and also since...

Minter and position privileges allow unrestricted minting and burning of arbitrary tokens

Lines of code Vulnerability details Any registered minter and a position belonging to him have absolute control of minting and burning tokens on all accounts. Impact New minting mechanisms are subject to governance approval i.e. can be veto’ed. These, however, will be arbitrary contracts with...

Challenger incentives can be inflated with external transfers

Lines of code Vulnerability details Impact The function notifyChallengeSucceeded calculates the volume of ZCHF to be repaid, which is then used to calculate the reward for the challenger. The challenger can however artificially inflate this value. A challenger can start a challenge on an...

There is no way to withdraw the Fees from the reserve contract

Lines of code Vulnerability details Impact This will mean 1000 of dollars worth of ZCHF in fees cannot be withdrawn by the owner Proof of Concept The reserve contract currentlyor can be the frankencoin contract also lacks a function for withdrawing ZCHF tokens, which are deposited as fees when...

Underflow in suggestMinter function

Lines of code Vulnerability details Impact The suggestMinter function in the smart contract allows users to suggest a new minter address by specifying an application period, an application fee, and a message. The function sets the mintersminter mapping to the current block timestamp plus the...

An attacker can mint himself many tokens for free by cloning a position and adjusting its price

Lines of code Vulnerability details Impact A malicious attacker can mint himself the max limit amount of tokens of any position for free, by cloning a position and manipulating its price. Proof of Concept Steps overview: 1. a The attacker clones an existing position 2. b The attacker sets the pri...

Reentrancy Attack Vulnerability in StablecoinBridge Contract

Lines of code Vulnerability details Impact The vulnerability can potentially drain the funds of the contract by allowing an attacker to repeatedly call the mint or burn functions and re-enter the mintInternal or burnInternal functions before they complete. Proof of Concept To deploy the...

Position ownership could be transferred to zero address

Lines of code Vulnerability details Impact Ownership of a Position could be transferred to zero address. This is usually caused by mistake but the consequence is loss of collateral. Proof of Concept The position owner calls transferOwnership but accidentally set newOwner address to 0x0. Tools Use...

Allowance not updated correctly

Lines of code Vulnerability details Impact allowance doesn't get updated properly therefore an attacker contract can exploit the token contract by transferring some tokens and still spend the same amount of allowance. Here are the steps: calling approve function from ERC20.sol with the spender...

Position.sol: usage of an incorrect version of Ownable library can potentially malfunction all onlyOwner functions

Lines of code Vulnerability details Impact // From https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/access/Ownable.sol The current implementaion is using a non-upgradeable version of the Ownable library isnstead of the upgradeable version:...