Price inflation by locking CVX on behalf of VotiumStrategy

Lines of code Vulnerability details Impact The price of vAfEth can be inflated with severe rounding errors as a result. Proof of Concept In VotiumStrategy the price of vAfEth is calculated by function cvxInSystem public view returns uint256 uint256 total = ILockedCvxVLCVXADDRESS.lockedBalanceOf...

Missing circuit breaker checks in ethPerCvx() for Chainlink's price feed

Lines of code Vulnerability details Bug Description The ethPerCvx function relies on a Chainlink oracle to fetch the CVX / ETH price: VotiumStrategyCore.solL158-L169 try chainlinkCvxEthFeed.latestRoundData returns uint80 roundId, int256 answer, uint256 / startedAt /, uint256 updatedAt, uint80 /...

VotiumStrategy withdrawal queue fails to consider available unlocked tokens causing different issues in the withdraw process

Lines of code Vulnerability details Summary Withdrawals in VotiumStrategy are executed in queue since CVX tokens are potentially locked in Convex. However, the implementation fails to consider the case where unlocked assets are already enough to cover the withdrawal, leading to different issues...

Withdrawal requests do not check if the amount of unlockable CVX is sufficient for withdrawals

Lines of code Vulnerability details Bug Description In AfEth.sol, whenever a user calls requestWithdraw to queue a withdrawal, the time that they can withdraw is determined by withdrawTime: AfEth.solL175-L176 function requestWithdrawuint256 amount external virtual uint256 withdrawTimeBefore =...

Lack of slippage protection for depositRewards() in AfEth.sol makes it susceptible to sandwich attacks

Lines of code Vulnerability details Bug Description In VotiumStrategyCore.sol, the buyCvx function calls exchangeunderlying of Curve's ETH / CVX pool to buy CVX: VotiumStrategyCore.solL233-L240 ICrvEthPoolCVXETHCRVPOOLADDRESS.exchangeunderlying value: ethAmountIn 0, 1, ethAmountIn, 0 // this is...

Users can deposit() even when Chainlink's price feed for CVX is stale

Lines of code Vulnerability details Bug Description In VotiumStrategy.sol, the price of vAfEth is determined by the price function: VotiumStrategy.solL31-L33 function price external view override returns uint256 return cvxPerVotium ethPerCvxfalse / 1e18; As seen from above, it calls ethPerCVX wit...

Missing slippage control when directly interacting with the VotiumStrategy contract

Lines of code Vulnerability details Summary Direct deposits and withdrawals within VotiumStrategy lack any slippage controls, which opens up the possibility of sandwich attacks and Miner Extractable Value MEV exploits. Impact Interactions in the AfEth protocol often require the exchange of ETH fo...

It might not be possible to applyRewards(), if an amount received is less than 0.05 eth

Lines of code Vulnerability details Vulnerability Details Upon claiming Votium rewards, applyRewards is intended to be invoked bi-weekly in order to exchange the tokens for eth and put the eth received back into the strategies. Based on the current ratio it either stakes the amount into safETH or...

Potential rewards stealing by manipulating CVX/ETH pool

Lines of code Vulnerability details Vulnerability Details Upon claiming Votium rewards, applyRewards is intended to be invoked in order to exchange the tokens for eth and put the eth received back into the strategies. Based on the current ratio it either stakes the amount into safETH or obtains...

AuraClaimZap may transfer CVX tokens to itself which become locked in the contract

Lines of code Vulnerability details Impact During AuraClaimZap.claimExtras if the option LockCvx is set to false then the contract will transfer CVX tokens from the msg.sender to this contract without forwarding them on to the user. There is no way to retrieve these funds from the protocol and...

Arithmetic Error - manualRebalance function has multiple arithmetic bugs

Handle tabish Vulnerability details In short there are 2 errors in manualRebalance function : a ratio currentLockRatio has been compared to balance newLockRatio and at another point in the same function subtracted . 1 Expanding on the first one - checking newLockRatio Solution: Instead the if...

veCVXStrategy.manualRebalance has wrong logic

Handle cmichel Vulnerability details Vulnerability Details The veCVXStrategy.manualRebalance function computes two ratios currentLockRatio and newLockRatio and compares them. However, these ratios compute different things and are not comparable: currentLockRatio =...

Code injection

Arista’s CloudVision eXchange CVX server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service crash and restart in the ControllerOob agent via a malformed control-plane packet...

CVE-2020-13100

Arista’s CloudVision eXchange CVX server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service crash and restart in the ControllerOob agent via a malformed control-plane packet...

CVE-2020-13100

Summary: CVE-2020-13100 affects Arista CloudVision eXchange (CVX) server. A malformed control-plane packet can cause the ControllerOob agent to crash, potentially impacting the control plane and, in HA clusters, triggering a master failover. Affected software: CVX server prior to 4.21.12M, 4.22.x...

Security Advisory 0052

Security Advisory 0052 PDF Date: October 7th, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | October 7th, 2020 | Initial Release The CVE-ID tracking this issue is: CVE-2020-13100 CVSSv3 Base Score: 7.5/10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description This advisory...

Arista Networks EOS Multiple Vulnerabilities (SA0018) (DROWN)

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library : - A cipher algorithm downgrade vulnerability exists due to a flaw that is triggered when handling cipher negotiation. A remote attacker can exploit this to...

Security Advisory 0018

Security Advisory 0018 PDF Date: March 1st, 2016 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | March 1st, 2016 | Initial release. Issue under investigation. 1.1 | March 7th, 2016 | Updated to include assessment Arista Products vulnerability report for security vulnerabilities released ...

Nortel CVX 1800 Multi-Service Access Switch Default SNMP Community Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4507/info Nortel CVX 1800 Multi-Service Access Switch is a hardware modem bank. The device contains a default SNMP community string of public, which may allow enable a remote attacker to gain access to sensitive informati...

CVE-2002-0540

Nortel CVX 1800 is installed with a default "public" community string, which allows remote attackers to read usernames and passwords and modify the CVX configuration...