How to Combat the Biggest Security Risks Posed by Machine Identities

The rise of DevOps culture in enterprises has accelerated product delivery timelines. Automation undoubtedly has its advantages. However, containerization and the rise of cloud software development are exposing organizations to a sprawling new attack surface. Machine identities vastly outnumber...

Incorrect amount of Collateral moves for Auction

Lines of code Vulnerability details Impact It was observed that the debt and collateral which moves for Auction is calculated incorrectly. In case where line.proportion is set to small value, chances are art will become lower than min debt. This causes whole collateral to go for auction, which wa...

There is no method to unignore any ignored pair.

Lines of code Vulnerability details Impact The Witch contract uses setIgnoredPair function to prevent the liquidation of accepted pairs on the governance level. However, there is no method to remove these pairs from the ignoredPairs mapping. Proof of Concept Imagine there are vaults with UST/fyUS...

Collateral limit can be bypassed in auction

Lines of code Vulnerability details Collateral limit could be bypassed, allowing more collateral to be auctioned concurrently than intended by governance. // There is a limit on how much collateral can be concurrently put at auction, but it is a soft limit. // If the limit has been surpassed, no...

Someone can create non-liquidatable auction if the collateral asset fails on transferring to address(0)

Lines of code Vulnerability details Impact might lead to systematic debt. Cause errors for liquidators to run normally. Proof of Concept In the function auction, there is on input validation around whether the to is address0 or not. and if the auctioneerReward is set to an value 0 as default, eac...

Liquidator cut is calculated incorrectly

Lines of code Vulnerability details Impact User can call payBase function to pay debt in return for collateral. But due to incorrect calculation User will obtain lesser collateral than what he should actually receive causing immediate permanent loss Proof of Concept 1. User calls payBase function...

Ransomware attack on US healthcare debt collector exposes 1.9m patient records

By Waqas The company maintains that it was able to "detect and stop" the "sophisticated ransomware attack" on February 26,… This is a post from HackRead.com Read the original post: Ransomware attack on US healthcare debt collector exposes 1.9m patient records...

debtresolution.com.my Cross Site Scripting vulnerability OBB-2668787

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

In CNote.sol, an attacker can DOS the money lending/debt repay functionalities for everybody

Lines of code Vulnerability details Impact Affected code: https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252...

Malicious code in synthetix-debt-pool-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f8bd0d8bcdad4b7b209807726e7da8c9129f86dbbf00570988c01ed9fd436a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6396 Malicious code in synthetix-debt-pool-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f8bd0d8bcdad4b7b209807726e7da8c9129f86dbbf00570988c01ed9fd436a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

How Software Architects Can Manage Technical Debt in a Microservice Architecture

By Owais Sultan Most software architects wear two different hats - they act as software engineers and technical leaders. However, software… This is a post from HackRead.com Read the original post: How Software Architects Can Manage Technical Debt in a Microservice Architecture...

amount requires to be updated to contract balance increase (3)

Lines of code Vulnerability details Impact Every time transferFrom or transfer function in ERC20 standard is called there is a possibility that underlying smart contract did not transfer the exact amount entered. It is required to find out contract balance increase/decrease after the transfer. Th...

Thousands of Borrowers' Data Exposed from ENCollect Debt Collection Service

An ElasticSearch server instance that was left open on the Internet without a password contained sensitive financial information about loans from Indian and African financial services. The leak, which was discovered by researchers from information security company UpGuard, amounted to 5.8GB and...

Anyone can rebalance vaults on behalf of owner and eventually extract funds

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept - rebalance When using Aave's flashLoan, a recipient can be specified. Therefore the access control of executeOperation in SuperVault is useless as anyone could take a flashloan to call...

A $3 Billion Silk Road Seizure Will Erase Ross Ulbricht's Debt

In a twist, a massive trove of stolen bitcoins will repay the dark web market creator's $183 million restitution...

setDebtInterestApr() doesn't accrue interest before changing it

Lines of code Vulnerability details Impact Wrong interest can be charged if interest is changed without calling accrue Proof of Concept The function setDebtInterestApr updates the interest charged on debt without calling accrue before to compute previous interests. If someone takes debt at 2% and...

[WP-M2] Wrong implementation of TurboSafe.sol#less() may cause boosted record value in TurboMaster bigger than actual lead to BoostCapForVault and BoostCapForCollateral to be permanently occupied

Lines of code Vulnerability details // Get out current amount of Fei debt in the Turbo Fuse Pool. uint256 feiDebt = feiTurboCToken.borrowBalanceCurrentaddressthis; // If our debt balance decreased, repay the minimum. // The surplus Fei will accrue as fees and can be sweeped. if feiAmount feiDebt...

TurboSafe - should override maxWithdraw and maxRedeem

Lines of code Vulnerability details Impact Considering the EIP , as withdraw must revert if it is not possible to withdraw assets , it is important to have an accurate maxWithdraw function. However, here, maxWithdraw does not account for the current max withdrawal in the cToken contract. Liquidit...

After debt seizure from InsuranceFund, user can dilute all past participants.

Lines of code Vulnerability details Impact A user can get a much larger portion of the pool as it recovers from a debt seizure. The intent of the insurance pool seems to be that it could recover from a bad debt event. Proof of Concept 1. Alice is the first LP to the insurance pool, and deposits...