onERC721Received() could delegatecall to transder the tokens

Lines of code Vulnerability details onERC721Received could delegatecall to transder the tokens Impact Some onERC721Received could use delegatecall to drain the tokens Putty holds. Because the msg.sender is Putty contract, the tarnsfer can go through. Or taking the ownership of the Putty contract...

if attacker gets admin private key then he can drain all the tokens that Lender.sol contract holds

Lines of code Vulnerability details Impact if attacker gets admin private key then he can drain all the tokens that Lender.sol contract holds Recommended Mitigation Steps make it harder for admin to do this with some internal sec requirements --- The text was updated successfully, but these error...

Overprivileged admin can grant unlimited WETH

Lines of code Vulnerability details Impact Admin can grantComp to any address using any amount and drain the contract. Proof of Concept If admin key gets compromised there is no timelock, no amount boundaries and no address limitations to prevent the assets to be drained immediately to the...

Re-entrancy in wfCashERC4626.redeem() can lead to more gains in assets and/or shares

Lines of code Vulnerability details Impact The redeem function in wfCashERC4626.sol can be re-entered at the point of redeemInternal. Assume underlying tokens are sent to receiver after shares are burnt, and user re-enters redeem after redeemInternal is completed., P.S: there's a separate issue o...

wfCashERC4626.withdraw() missing some asset balance checks and calculations can drain contract

Lines of code Vulnerability details Impact The withdraw function in wfCashERC4626.sol has no check for asset token balanceOf and calculations before and after transfer. With this, a user can keep calling withdraw multiple times and keep gaining more assets. Proof of Concept 1. Assume redeemIntern...

Repeated calls to deliverBribes() risks draining bribe of assets into Gauge

Lines of code Vulnerability details Impact Funds drain from Bribe prematurely with repeated calls to deliverBribes Proof of Concept Calling deliverBribes calls deliverRewards which transfers the amount specified as the rewards due and sends to gauge. Repeated calls to deliverBribes makes repeated...

kernel: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq()

A vulnerability was found in the Linux kernel while parsing the txq list in the lpfcdraintxq function. Due to improper handling of a local fail message string which is set when a job fails and is never unset for subsequent jobs, this issue can lead to list corruption as jobs may be added to both...

Out-of-bounds

Evmos is the Ethereum Virtual Machine EVM Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmo...

CVE-2022-24738

Evmos prior to v2.0.1 is vulnerable to draining unclaimed funds by an attacker who creates a malicious chain that does not enforce signature verification and connects it to a target Evmos instance via IBC, enabling migration of claim records and fund transfer. The issue stems from a vulnerability...

Gas Pricing Can Be Used To Extort Funds From Users of SChain Owner

Lines of code Vulnerability details Impact The function refundGasByUser can be exploited by the message sender to drain nodes and SChain owners of their balances when processing incoming messages. When a node collates a set of exits from an SChain to Ethereum, they are submitted on-chain via...

Can drain ETHERBASE

Lines of code Vulnerability details Impact The postIncomingMessages function tops up the contract with the gas token in topUpBalance. Note that the amount of gas tokens to be topped up from the ETHERBASE contract depends on msg.sender.balance, the caller's gas token balance. Attackers with a zero...

double spend in Shelter

Lines of code Vulnerability details in the withdraw function in Shelter, one can withdraw infinite times, and by doing so, draining the system. the function doesn't check that the shares aren't already withdrawn. --- The text was updated successfully, but these errors were encountered: All reacti...

Shelter withdraw does not check if user already claimed

Lines of code Vulnerability details Impact Shelter withdraw does not check if user already claimed. This allow any user with non-zero claim to drain the Shelter. Proof of Concept function withdrawIERC20 token, address to external override requireactivatedtoken != 0 && activatedtoken + GRACEPERIOD...

Owner can set arbitrary premium which allow nonStakers drain funds

Handle wuwe1 Vulnerability details Impact Owner can set arbitrary premium, this will cause protocol lose all the activeBalance, stakers lose all the claimable premium and nonStakers can drain all the usdc. Proof of Concept setProtocolPremium does not check the value of premium. premium can be...

first liquidity provider can drain others

Handle danb Vulnerability details Impact first liquidity provider can drain others Proof of Concept consider the following scenario: a malicious user creates the usdc-usdt pool, they provided 1 basic unit of usdt and 1 basic unit of usdc 1/106 each the amount of liquidity token that will be minte...

DEPLOYER can drain underlying asset deposited by AaveV2Strategy and drain SHER token in SherDistributionManager

Handle wuwe1 Vulnerability details Proof of Concept For sdm. DEPOLYER can call pullReward and send arbitrary amount of sher in sdm to the DEPOLYER. For AaveV2Strategy.sol , attacker can call withdrawAll and drain the underlying asset if there is any. Recommended Mitigation Steps Add Timelock on...

Inefficient Regular Expression Complexity in marked

Impact What kind of vulnerability is it? Denial of service. The regular expression block.def may cause catastrophic backtracking against some strings. PoC is the following. javascript import as marked from "marked"; marked.parsex:$' '.repeat1500x $' '.repeat1500 x; Who is impacted? Anyone who run...

[WP-H20] Wrong implementation of withdrawRedundant() allows the Vault owner to drain all the funds

Handle WatchPug Vulnerability details Based on the context, withdrawRedundant intends to disallow the owner to withdraw more Vault tokens than the surplus amount. However, the current implementation is wrong, which allows the Vault owner to drain all the funds. function withdrawRedundantaddress...

Silicon Labs Z-Wave Chipsets 资源管理错误漏洞

Silicon Labs Z-Wave Chipsets are a type of chipset in the smart home ecosystem from Silicon Labs, USA. The Silicon Labs Z-Wave Chipsets suffers from a resource management error vulnerability that stems from the fact that Z-Wave devices are based on the Silicon Labs 500 series chipsets, which use...

PT-2022-9072 · Schlage +1 · Schlage Be468 +1

Name of the Vulnerable Software and Affected Versions: Z-Wave devices based on Silicon Labs 500 series chipsets Schlage BE468 version 3.42 Description: The issue affects Z-Wave devices that use S0 authentication, leading to uncontrolled resource consumption and resulting in battery exhaustion. Fo...