CVE-2021-34272

A security flaw in the 'owned' function of a smart contract implementation for RobotCoin RBTC, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

CVE-2021-34273

A security flaw in the 'owned' function of a smart contract implementation for BTC2X B2X, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

Integer overflow

An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses between two large accounts during a transaction...

Security feature bypass

A security flaw in the 'owned' function of a smart contract implementation for RobotCoin RBTC, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

Integer overflow

An integer overflow in the mintToken function of a smart contract implementation for Doftcoin Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses...

CVE-2021-34273

A security flaw in the 'owned' function of a smart contract implementation for BTC2X B2X, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

CVE-2021-34273

The CVE-2021-34273 entry describes a vulnerability in BTC2X (B2X), a tradable Ethereum ERC20 token. The issue is in the smart contract’s owned function, tied to “unprotected ownership,” which can enable an attacker to hijack a victim’s account and arbitrarily increase the token supply. Several so...

CVE-2021-34272

The CVE-2021-34272 entry concerns RobotCoin (RBTC), a tradeable Ethereum ERC20 token implemented via a smart contract. The vulnerability is in the contract’s owned function, described as enabling attackers to hijack victim accounts and arbitrarily increase the token’s digital supply. The connecte...

CVE-2021-34272

A security flaw in the 'owned' function of a smart contract implementation for RobotCoin RBTC, a tradeable Ethereum ERC20 token, allows attackers to hijack victim accounts and arbitrarily increase the digital supply of assets...

CVE-2021-34270

The CVE-2021-34270 entry concerns Doftcoin Token (an Ethereum ERC20 token) with an integer overflow in the mintToken function. The vulnerability is an arithmetic overflow in the token minting path, potentially allowing the owner to cause financial losses; exploitation details are not provided in ...

CVE-2021-34270

An integer overflow in the mintToken function of a smart contract implementation for Doftcoin Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses...

CVE-2021-33403

The CVE concerns LNCToken (Lancer Token), an Ethereum ERC-20 token. The vulnerability is an integer overflow in the transfer function of the smart contract, which could allow the owner to cause unexpected financial losses between two large accounts during a transaction. The connected sources (inc...

CVE-2021-33403

An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses between two large accounts during a transaction...

BTC2X 安全漏洞

BTC2X B2X is an application. The smart contract implements its own functionality, a tradable Ether ERC20 token with unprotected ownership, which allows anyone to become the owner of the contract, including the recipient. there is a security vulnerability in BTC2X that could be exploited by an...

Cross-Site Request Forgery (CSRF) in devcode-it/openstamanager

✍️ Description Attacker able to create any Contract if users visit attacker site. 🕵️‍♂️ Proof of Concept 1.Open the PoC.html In Firefox or safari. 2.now you can check a Contract with aaaa name have been created. // PoC.html history.pushState'', '', '/' document.forms0.submit; 💥 Impact This...

reputation risk via upgradable contracts

Handle gpersoon Vulnerability details Impact The contract SwappableYieldSource is upgradable. This means the owner could upgrade and change the contract so any new functionality. Amongst others the owner could retrieve all the tokens of the Yieldsource and transfer them out. The project could sti...

_token parameter not validated

Handle pauliax Vulnerability details Impact function depositProtocolBalance does not validate the token, nor the caller. It is possible to call this function passing any arbitrary token and amount values and thus artificially increasing protocolBalance which may lead to further failed computation...

Incorrect internal balance bookkeeping

Handle walker Vulnerability details type: Incorrect Assumptions on External Systems The sherlock smart contract system uses internal bookkeeping of arbitrary ERC20 token balances. It doesn't assert that the ERC20 doesn't implement some non-standard behaviour. For example, deflationary tokens, or...

Flash loan manipulation on getPoolShareWeight of Utils

Handle shw Vulnerability details Impact The getPoolShareWeight function returns a user's pool share weight by calculating how many SPARTAN the user's LP tokens account for. However, this approach is vulnerable to flash loan manipulation since an attacker can swap a large number of TOKEN to SPARTA...

Return values of BEP20.transfer and BEP20.transferFrom are unchecked

Handle shw Vulnerability details Impact The return values of BEP20.transfer and BEP20.transferFrom are not checked to be true in multiple contracts. The return value could be false if the transferred token is not BEP20-compliant, indicating that the transfer fails, while the calling contract will...