Rounding in the unwrap function in rUSDY may cause fund loss for users.

Lines of code Vulnerability details Impact Rouding with BPSDENOMINATOR in function unwrap in rUSDY.sol may cause users to be transfered back less than expected USDY. POC The rUSDY.sol contract provides a way to wrap an amount of USDY as shares in order to gain profit in rUSDY. This is done throug...

ERRORNEOUS RETURN VALUE PROVIDED BY THE UniV2LiquidityAmo.getLpTokenBalanceInWeth FUNCTION DUE TO PRECISION ERROR

Lines of code Vulnerability details Impact The UniV2LiquidityAmo.getLpTokenBalanceInWeth function is used to return the LP token balance of the contract in weth. It calls the getLpPrice function which is expected to return the LP price in 1e8 precision. getLpPrice function calls the...

BondManager.updateTranscoderWithFees wrong decimal multiplication. Function always revert due to underflow

Lines of code Vulnerability details BondingManager.sol have 2 mathUtils libraries, MathUtils use 1e6 as precision while PreciseMathUtils use 1e27 as precision. Some variable use MathUtils while other use PreciseMathUtils which might cause confusion. It happen with treasuryRewardCutRate variable...

EulerOS 2.0 SP9 : ntp (EulerOS-SA-2023-2621)

According to the versions of the ntp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cpcpdec while loop. An adversary may be able to attack a client ntpq...

Potential Precision Loss in claimFee() due to Division Before Multiplication

Lines of code Vulnerability details Impact The function claimFee may result in precision loss when calculating the addedValue variable. This issue arises due to division being performed before multiplication, leading to the possibility of truncated values and incorrect results. Proof of Concept T...

TapOFT.sol: Incorrect emission value due to division by higher decimal value

Lines of code Vulnerability details Impact Incorrect emission value which will be used in per week emission. Proof of Concept TapOFT.sol has the computeEmission function to calculate the emitted value. The output from this function is used in emitForWeek. when we look at the function...

CTokenV3Collateral._underlyingRefPerTok should use the decimals from underlying Comet.

Lines of code Vulnerability details Impact CTokenV3Collateral.underlyingRefPerTok uses erc20Decimals which is the decimals of CusdcV3Wrapper. But it should use the decimals of the underlying Comet. Proof of Concept CTokenV3Collateral.underlyingRefPerTokcomputes the actual quantity of whole...

AirdropBroker.sol#L442 : _participatePhase3 - PHASE_3_AMOUNT_PER_USER should be multiplied by 1e18

Lines of code Vulnerability details Impact Incorrect eligibleAmount is minted to the user. Proof of Concept An eligible user can call the participatePhase3 function and mint the aToken to them. function participatePhase3 bytes calldata data internal returns uint256 oTAPTokenID uint256 tokenID =...

Incorrect Interest Accrual Calculation in 'SGLCommon' Contract

Lines of code Vulnerability details Description The 'SGLCommon' contract contains a critical vulnerability in the interest accrual calculation, particularly in the computation of the 'extraAmount' used for accruing interest. The flaw arises from always dividing by 1e18, disregarding the number of...

Missing validation checks on sending non blocking LZ payload

Lines of code Vulnerability details Impact In OFTCoreV2 provided as example by LayerZero function sendaddress from, uint16 dstChainId, bytes32 toAddress, uint amount, address payable refundAddress, address zroPaymentAddress, bytes memory adapterParams internal virtual returns uint amount...

mintYieldFee function does not check for the maxMint amount.

Lines of code Vulnerability details Impact Theoretically, it is possible to mint more than the maxMint amount using the mintYieldFee function in the Vault contract. Proof of Concept The functions in Vault contract like mint, mintWithPermit call the beforeMint function which checks whether shares...

GHSA-CRQG-JRPJ-FC84 Apache Johnzon Deserialization of Untrusted Data vulnerability

A malicious attacker can craft up some JSON input that uses large numbers numbers such as 1e20000000 that Apache Johnzon will deserialize into BigDecimal and maybe use numbers too large which may result in a slow conversion Denial of service risk. Apache Johnzon 1.2.21 mitigates this by setting a...

Decimal is not correct in fee calculation

Lines of code Vulnerability details Impact The decimal doesn't match in the fee calculation, so this will break the fee calculation. Since fee calculation is very important in Mint/Burn actions, this problem can ruin the core functionality of transmuter. Proof of Concept This is the non-exact min...

_normalizeDecimals() Wrong calculation formula

Lines of code Vulnerability details Impact Wrong decimal place conversion, resulting in wrong quantity Proof of Concept in callOutSignedAndBridge The number of tokens will be converted to 18 decimal when packedData is performed. function callOutSignedAndBridgebytes calldata params, DepositInput...

_createDepositSingle() call bridgeOut missing normalizeDecimals

Lines of code Vulnerability details Impact Wrong decimal place conversion, resulting in wrong quantity Proof of Concept in createDepositSingle will call IPortlocalPortAddress.bridgeOut The parameter deposit is not converted to 18 decimal createDepositSingle function createDepositSingle address...

Incorrect maxSwapAmount checked

Lines of code Vulnerability details Impact On onboarding, a part of the the received tokens will be swapped for 4 canto. To partially protect users, a maximum amount of tokens to be used for the swap is set. According to the documentation: For risk management purposes, a swap will fail if the inp...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current ntp Multiple Vulnerabilities (SSA:2023-153-02)

The version of ntp installed on the remote host is prior to 4.2.8p16. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-153-02 advisory. - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cpcpdec while loop. An adversary may be able ...

Medium: mariadb

Issue Overview: getsortbytable in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY. CVE-2021-46657 MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW. CVE-2021-46659 MariaDB through...

new finding

Lines of code L2 Vulnerability details test Assessed type Decimal --- The text was updated successfully, but these errors were encountered: All reactions...

Precision differences when calculating the _startAuction of funds accumulated in RiskFund

Lines of code Vulnerability details Impact When calculating startAuction uint256 usdValue in RiskFund, Auction state divides the value of each market in the vToken list in token list precision. This skew is fine for most tokens but will cause problems with certain token pairs. Proof of Concept Wh...