CVE-2022-31153 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts vanilla and ethereum flavors in the...

CVE-2022-31153 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli

OpenZeppelin Contracts for Cairo is a library for contract development written in Cairo for StarkNet, a decentralized ZK Rollup. Version 0.2.0 is vulnerable to an error that renders account contracts unusable on live networks. This issue affects all accounts vanilla and ethereum flavors in the...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts for Cairo v0.2.0 that stems from a bug in OpenZeppelin Contracts for Cairo v0.2.0 that causes account contracts to be unavailable on the live network...

Unchecked transfer

Lines of code Vulnerability details Description The return value of an external transfer/transferFrom call is not checked Impact There are some tokens that do not revert on failure but return false instead, if such token is used, the return value won'...

DOS(Denial Of Service).External calls can fail accidentally or deliberately, which can cause a DoS condition in the contract.

Lines of code Vulnerability details Impact --Check: calls-loop --Severity: Medium --Confidence: Medium External calls can fail accidentally or deliberately, which can cause a DoS condition in the contract. There are two instances where this can occur. Proof of Concept -- --ConsenSys Smart...

Use of IERC20.transfer() instead of SafeERC20.safeTransfer()

Lines of code Vulnerability details Impact There are multiple external calls to IERC20.transfer and IERC20.transfer in contracts that suppose to transfer out tokens from/to the system. However, there are tokens like USDT that don't return any return value in their implementation of the transfer...

Centralized mint

Lines of code Vulnerability details Impact The mint method is too centralized. Proof of Concept Using the mint function of ERC20MinterBurnerDecimals, the minter address can mint arbitrary amount of tokens. If the private key of the owner or minter address is compromised, the attacker will be able...

removeAddress doesn't decrease the contracts.length

Lines of code Vulnerability details Impact The contracts length will always increase because the removeAddress function just deleting the value inside the array and never decrease the length by calling pop method. This can lead to Dos when calling functions that doing loop on contracts storage:...

Sending batch withdrawal requests can possibly DoS

Lines of code Vulnerability details Impact The function BatchRequests.sendWithdrawalRequests allows calling the sendWithdrawalRequests function on all of the Yieldy contracts at once. However, due to the unbounded for loop, if many Yieldy contracts are added to contracts, this function can...

Malicious NFT

Lines of code Vulnerability details Impact Anybody can create a vault which fractionalizes their NFT. However, this process should go through a whitelist and review process because a maliciously implemented NFT contracts can reclaim ownership of the contract despite it technically being 'owned' b...

Proxy storage collision - contracts might be bricked

Lines of code Vulnerability details The proxy contracts save the implementation variables in the first storage slot see links above. This will lead to storage collusions when the implementation contract tries to read/update the first storage slot. For the implementation contract, the first storag...

MAL-2022-565 Malicious code in @robinhoodcoop/contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79fa03f4a31da2397b472176a93488bd3d877f542dee8d065c78a2208255e065 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in token-registry-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb7c82a6c53a23b3bb67aacbe356d46f587a8d58c104fbef187519e4ad1f30ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6782 Malicious code in union-finance-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 864f2a7a59e93388fda46cda69a405d50e420ee9a3e50c40af312175b6a08850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in union-finance-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 864f2a7a59e93388fda46cda69a405d50e420ee9a3e50c40af312175b6a08850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in everest-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware daf5d08f81a8f2c17042f4d380e1b453cce7a49d9d7da863da126e8b4522be1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2897 Malicious code in everest-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware daf5d08f81a8f2c17042f4d380e1b453cce7a49d9d7da863da126e8b4522be1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arbos-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6effb9213f79f35fea7e912b6bc7c9047b1815c7fc6c70ea532558d76ca20fff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1079 Malicious code in arbos-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6effb9213f79f35fea7e912b6bc7c9047b1815c7fc6c70ea532558d76ca20fff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tidal-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e47633a084020158369ef4e87e8387eb83ad513939de494380781ebe71b53f69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...