5613 matches found
The attacker consumes the contract's balance by controlling the gas-price or gas-used.
Lines of code Vulnerability details Impact The attacker consumes all of the contract's balance by controlling the gasPrice and gasUsed. Proof of Concept function refundGasuint256 startGas internal unchecked uint256 balance = addressthis.balance; if balance == 0 return; uint256 gasPrice =...
Malicious Package
Overview avalanche-smart-contract-quickstart is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerab...
Ethermint vulnerable to DoS through unintended Contract Selfdestruct
Vulnerability Report Impact Smart contract applications that make use of the selfdestruct functionality and their end-users. Classification The vulnerability has been classified as high with a CVSS score of 8.2. It has the potential to create a denial-of-service to all contracts that can invoke t...
CVE-2022-35198
Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information...
CVE-2022-35198
Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information...
CVE-2022-35198
The CVE-2022-35198 entry concerns Contract Management System v2.0 with a weak default password that can expose database connection information. This vulnerability is supported by multiple connected records noting the same issue, including a High severity CVSS 3.1 score (7.5), attack vector networ...
CVE-2022-35198
Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information...
PT-2022-22628 ยท Unknown ยท Contract Management System
Name of the Vulnerable Software and Affected Versions: Contract Management System version 2.0 Description: The issue is related to a weak default password in the Contract Management System, which allows attackers to access database connection information. Recommendations: For Contract Management...
Contract Management System ๆๆ้ฎ้ขๆผๆด
Contract Management System is a contract management system. It enables companies to create new contracts and track the status of existing contracts to ensure that employees, vendors, and customers meet defined requirements. A security vulnerability exists in Contract Management System version v2....
Exposure of Resource to Wrong Sphere
Ethermint is an Ethereum library. In Ethermint running versions before v0.17.2, the contract selfdestruct invocation permanently removes the corresponding bytecode from the internal database storage. However, due to a bug in the DeleteAccountfunction, all contracts that used the identical bytecod...
Approved Borrower can can walk away with collateral in leveraged borrowed Position
Lines of code Vulnerability details Impact When an approved borrower calls leveragedPosition , their userBorrowShares and userCollateralBalance values are updated. The borrow will be able to walk away with collateral balance by adding more collateral to pass the isSolvent check and remove all the...
Not calling approve(0) before setting a new approval might cause reverts when used with Tether (USDT)
Lines of code Vulnerability details Impact Some tokens do not implement the ERC20 standard properly but are still accepted by most code that accepts ERC20 tokens. For example Tether USDT's approve function will revert if the current approval is not zero, to protect against front-running changes o...
repayAsset() but you will not receive your Collateral
Lines of code Vulnerability details Impact The user will just pay down the debt Proof of Concept By invoking repayAsset you will just pay the Asset Token, on the other hand, he does not send any amount of my Collateral Recommended Mitigation Steps Add a function to send the Collateral after...
Format string
OpenZeppelin Contracts is a library for secure smart contract development. The functions ECDSA.recover and ECDSA.tryRecover are vulnerable to a kind of signature malleability due to accepting EIP-2098 compact signatures in addition to the traditional 65 byte signature format. This is only an issu...
Bad access control in AdminRole.sol can lead to all funds being stolen from FoundationTreasury.sol
Lines of code Vulnerability details Proof of concept FoundationTreasury.sol inherits CollateralManagement.sol which has the method function withdrawFundsaddress payable to, uint256 amount external onlyAdmin that can withdraw the whole balance of the treasury to the to address. It looks like it is...
VotingEscrow: uninitialized blocklist will DOS the contract
Lines of code Vulnerability details Impact The checkBlocklist modifier calls the isBlocked function for the blocklist address, but the blocklist is not initialized in the constructor, only assigned by the owner in the updateBlocklist function. This means that after the contract is deployed and...
VotingEscrow Ownership Management Lacks Basic Protections
Lines of code Vulnerability details Impact A comment saying "Owner should always be a timelock contract" is not sufficient protection for something as critical as ownership. There should be: a zero address check on addr a propose/transfer method of ownership transfer, not a unilateral transfer...
Blocklist contract lack an unblock mechanism
Lines of code Vulnerability details Impact In Blocklist contract, the manager can block a contract from accessing VotingEscrow by calling the block function. If the manager calls the block function on a contract due to some misunderstanding, the manager cannot resume the contract's access to...
mintFromFixedPriceSale for a custom contract can lead to users losing funds
Lines of code Vulnerability details mintFromFixedPriceSale for a custom contract can lead to users losing funds NFTDropMarketFixedPriceSale.createFixedPriceSale allows creators to create a sale drop. A creator can create a drop sale for their custom NFT Contract that adheres to...
Missing onlyCreator modifier on minting functions
Lines of code Vulnerability details Impact Missing onlyCreator modifier or any access-control to the NFTCollection.sol mint function makes all of the contract's minting functions absolutely open to any user. Proof of Concept All minting functions in the NFTCollection contract: mintAndApprove...