You can front-run to enrich yourself

Lines of code Vulnerability details Impact An attacker can use flash loan and withdraw significant part of funding intended for collateral providers. Proof of Concept Let's consider code snippet from deposit: requireshares = previewDepositassets != 0, "ZEROSHARES";...

the perpetualVaultLP.sol is vulnable by flashloan attack

Lines of code Vulnerability details impact The perpVaultLp contract is susceptible to a flash loan attack. An attacker can exploit the vulnerability by executing flash loan transactions using both the deposit and redeem functions. This allows the attacker to acquire extra rdpx tokens and increase...

reserve balances AND reserve balance ratio INVARIANTS ARE NOT CHECKED INSIDE THE _reserveTokenSpecified FUNCTION THUS ENABLING deposit AND withdraw TRANSACTIONS TO BREAK THESE INVARIANTS

Lines of code Vulnerability details Impact The EvolvingProteus.depositGivenInputAmount function is used to calculate the output amount of LP tokens given an input amount of reserve tokens. The EvolvingProteus.withdrawGivenOutputAmount function is used to calculate the amount of LP tokens that mus...

Missing _checkAmountWithBalance check in deposit functions

Lines of code Vulnerability details Impact When computing the input or output amount of a swap checkAmountWithBalance is called to ensure that precision errors do not occur and that the pool does not lose any value. However, checkAmountWithBalance is not called in depositGivenInputAmount and...

Missing balance checks in _reserveTokenSpecified()

Lines of code Vulnerability details Impact By calling depositGivenInputAmount and withdrawGivenOutputAmount which both call 'reserveTokenSpecified', users may potentially create scenarios where the balance ratio allowed for the EvolvedProtocol.sol deployment is violated. POC depositGivenInputAmou...

Utility per LP token can decrease in some cases.

Lines of code Vulnerability details Impact Utility per LP token can decrease in some cases. Proof of Concept The documentation in contest repo states that Within a timeslice a single block, no set of transactions swaps, deposits, withdrawals should result in a decrease of the utility per LP token...

Improper handling of cases when total supply = 0

Lines of code Vulnerability details Impact Improper handling of cases when total supply = 0 AMM engine may not be started. Proof of Concept Considering if a vault uses Shell as its AMM engine. At the start, the vault has 0 X and Y balance and someone try to deposit tokens to it, this process will...

_reserveTokenSpecified does not check if price is in allowed range

Lines of code Vulnerability details Impact Price could go out of range Proof of Concept EvolvingProteus defines a price range using 2 constants, MAXM and MINM: int128 constant MAXM = 0x5f5e1000000000000000000; int128 constant MINM = 0x00000000000002af31dc461; These constants are used in...

M-22 Unmitigated

Lines of code Vulnerability details Comments The underlying yield vaults used by the V5 vaults usually round down shares received when depositing. As a result, if the Vault deposits to an underlying yield vault that has already issued shares, it is possible that a deposit could be rounded down to...

Loss of precision in the YieldVault causes DoS when depositing from the Vault

Lines of code Vulnerability details Title Loss of precision in the YieldVault causes DoS when depositing from the Vault Original Issue M-22 - Loss of precision leads to undercollateralized Details The original demonstrates how the Vault could fall into undercollateralization mode if the YieldVaul...

H-05 Unmitigated

Lines of code Vulnerability details Issue not mitigated About the problem sponsor function allows caller to delegate his shares to the special address. In this case caller losses ability to win prizes. Previous version of code had sponsor function, which allowed to deposit funds on behalf of owne...

ChurchCRM Cross-Site Scripting Vulnerability (CNVD-2023-64218)

ChurchCRM is an open source CRM system for churches. A cross-site scripting vulnerability exists in ChurchCRM version 4.2.1, which stems from the lack of effective filtering and escaping of user-supplied data in the Add New Deposit field of the View All Deposit module, and can be exploited by an...

CVE-2020-28849

Cross Site Scripting XSS vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module...

CVE-2020-28849

Cross Site Scripting XSS vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module...

Cross site scripting

Cross Site Scripting XSS vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module...

CVE-2020-28849

Cross Site Scripting XSS vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module...

CVE-2020-28849

ChurchCRM 4.2.1 is affected by a Cross-Site Scripting (XSS) vulnerability in the Add New Deposit field of the View All Deposit module. The flaw arises from insufficient input filtering/escaping of user-supplied data, enabling remote attackers to inject arbitrary script or HTML. Multiple connected...

PT-2023-11772 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.2.1 Description: The issue allows remote attackers to execute arbitrary code and gain sensitive information via a crafted payload in the Add New Deposit field in the View All Deposit module. This is a Cross Site Scripting...

ChurchCRM 跨站脚本漏洞

ChurchCRM is an open source CRM system for churches. A cross-site scripting vulnerability exists in ChurchCRM version 4.2.1, which stems from the lack of effective filtering and escaping of user-supplied data in the Add New Deposit field of the View All Deposit module, and can be exploited by an...

CVE-2020-28849

Cross Site Scripting XSS vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module...