Possible DoS attack in creating new DAO proposals

Handle shw Vulnerability details Impact The functions of creating new DAO proposals e.g., newActionProposal are permissionless. Anyone can create a new proposal by paying some fees in SPARTA, as long as the previous proposal is closed. Thus, an attacker could then front-run proposals of benign...

Improper access control of claimAllForMember allows anyone to reduce the weight of a member

Handle shw Vulnerability details Impact The claimAllForMember function of Dao is permissionless, allowing anyone to claim the unlocked bonded LP tokens for any member. However, claiming a member's LP tokens could decrease the member's weight in the BondVault, thus affecting the member's votes and...

Dao has unchecked transfers

Handle heiho1 Vulnerability details Impact Dao.moveBASEBalanceaddress and Dao.handleTransferInaddress,uint256 do not check transfer return values on lines 220 and 266. If the token implementation returns false and does not revert, then potentially the user can deposit for free. Proof of Concept...

Broken access control leads to protocol functionality freeze

Handle 0xRajeev Vulnerability details Impact The contracts use an access control pattern where the contract deployer is included in the onlyDAO modifier which is used for authorized access to critical functions. Such contracts also include a purgeDeployer function which renounces sets to...

BondVault BASE incentive can be gamed

Handle cmichel Vulnerability details BondVault deposits match any deposited token amount with the BASE amount to provide liquidity, see Docs and DAO.handleTransferIn. The matched BASE amount is the swap amount of the token trade in the pool. An attacker can manipulate the pool and have the DAO...

Missing purgeDeployer function

Handle 0xsanson Vulnerability details Impact In most of the contracts there's a purgeDeployer function that sets the Deployer address to zero. Contracts synthVault and Router though don't have it. Since the idea is to decentralize the protocol giving all the power to the Dao, the function should ...

Missing function setParams in Dao

Handle 0xsanson Vulnerability details Impact The function setParams in synthVault is supposed to be called by the Dao, but this contract doesn't have it, causing the impossibility to update the parameters by the protocol. Proof of Concept Tools Used editor Recommended Mitigation Steps Add the...

Anyone can curate pools and steal rewards

Handle @cmichelio Vulnerability details Vulnerability Details The Router.curatePool and replacePool don't have any access restriction. An attacker can get a flash loan of base tokens and replace existing curated pools with their own curated pools. Impact Curated pools determine if a pool receives...

Anyone can list anchors / curate tokens

Handle @cmichelio Vulnerability details Vulnerability Details The Router.listAnchor function can be called by anyone and tokens can be added. The only check is that requireiPOOLSPOOLS.isAnchortoken; but this can easily be set by calling Pools.addLiquidityVADER, token, once even without actually...

You can vote for proposal already completed

Handle s1m0 Vulnerability details Impact The mapPIDfinalised is set on completeProposal but voteProposal doesn't check it. A malicious user with enough capital and/or together with other people could execute a proposal in his favor e.g. a grant infinitely. Proof of Concept 1 newGrantProposal 2...

Undefined behavior for DAO and GRANT vote proposals in DAO.sol

Handle 0xRajeev Vulnerability details Impact Given that there are only three proposal types GRANT, UTILS, REWARD that are actionable, it is unclear if 'DAO' type checked in voteProposal is a typographical error and should really be 'GRANT'. Otherwise, GRANT proposals will only require quorum 33%...

changeDAO should be a two-step process in Vader.sol

Handle 0xRajeev Vulnerability details Impact changeDAO updates DAO address in one-step. If an incorrect address is mistakenly used and voted upon then future administrative access or recovering from this mistake is prevented because onlyDAO modifier is used for changeDAO, which requires msg.sende...

Remote Code Execution (RCE)

dolphinscheduler-dao is vulnerable to remote code execution. Using MySQL database with connectorj, an attacker can inject a malicious code in the DolphinScheduler server through jdbc connect parameters input "detectCustomCollations":true,"autoDeserialize":true...

Sql injection

The DAO/DTO implementation in SpringBlade through 2.7.1 allows SQL Injection in an ORDER BY clause. This is related to the /api/blade-log/api/list ascs and desc parameters...

Aurora DAO Security Breach

Aurora DAO AURA is a decentralized trading system for Ether ECR-20 tokens. A security vulnerability exists in AURA's Owned smart contract implementation. An attacker could exploit the vulnerability to gain ownership of the contract, causing a denial of service...

Denial Of Service (DoS)

ph-dao is vulnerable to denial of serviceDoS attack. The attacker can trigger DoS when AbstractWALDAO is used without a backing file...

The block chain smart contracts vulnerability, wanted to say your not easy-bug warning-the black bar safety net

In recent days, the block chain platform EOS smart contract vulnerability event once again put on the block chain safe to push on the cusp. An attacker can release contains malicious code“smart contract”, after a series of after the operation, the control block chain, all nodes in the network, an...

Aurora DAO Denial of Service Vulnerability

Aurora DAO AURA is a decentralized trading system for Ether ECR-20 tokens. A security vulnerability exists in the Owned smart contract implementation in AURA. An attacker could exploit the vulnerability to gain ownership of the contract, causing a denial of service...

CVE-2018-10705

The Owned smart contract implementation for Aurora DAO AURA, an Ethereum ERC20 token, allows attackers to acquire contract ownership because the setOwner function is declared as public. An attacker can then conduct a lockBalances denial of service attack...

CVE-2018-10705

The Owned smart contract implementation for Aurora DAO AURA, an Ethereum ERC20 token, allows attackers to acquire contract ownership because the setOwner function is declared as public. An attacker can then conduct a lockBalances denial of service attack...