59 matches found
Malicious code in utils-dust (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc48096a3c9ec1e7db0ddab8489b841ccde69100000ded1c48c7cd9a87426520 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Value of totalProfit might be wrong because of wrong logic in function sellMalt()
Lines of code Vulnerability details Impact Contract SwingTraderManager has a totalProfit variable. It keeps track of total profit swing traders maded during sellMalt. However, the logic for accounting it is wrong so it will not have the correct value. As the results, it can affect other contracts...
Dust.js 安全漏洞
Dust.js is a LinkedIn open source asynchronous Javascript template for browsers and servers. A security vulnerability exists in Dust.js version 3.0.0, which stems from some unknown functionality that manipulates to cause improperly controlled modification of object prototype properties "prototype...
Upgraded Q -> M from #164 [1668687728737]
Judge has assessed an item in Issue 164 as M risk. The relevant finding follows: 01 Lack of check if dust ether transfer is successful --- The text was updated successfully, but these errors were encountered: All reactions...
Upgraded Q -> M from #336 [1668467652322]
Judge has assessed an item in Issue 336 as M risk. The relevant finding follows: L-1: Volatility accumulator can be be prevented from decaying by way of dust transactions There is no required minimum swap amount for updating the volatility accumulated. The fp.time is always updated during a swap...
The function _execute could be called externally
Lines of code Vulnerability details Author: rotcivegaf Impact The execute use a modifier to only can called internally, also specified in the documentation of the function: Must be called internally. But this modifier can be pass if a contract call the execute or bulkExecute and in the returnDust...
_payoutEth() calculates balance with an offset, always leaving dust ETH in the contract
Lines of code Vulnerability details Payout recipients can call getEthPayout to transfer the ETH balance of the contract to all payout recipients. This function makes an internal call to payoutEth, which sends the payment to the recipients based on their associated bp The issue is that the balance...
Malicious DepositBase may stole dust fund from ReceiverImplementation
Lines of code Vulnerability details Impact Malicious DepositBase may stole dust fund from ReceiverImplementation Proof of Concept // @dev This function is used for delegate by DepositReceiver deployed above // Context: msg.sender == AxelarDepositService, this == DepositReceiver function...
WEF - Wi-Fi Exploitation Framework
A fully offensive framework to the 802.11 networks and protocols with different types of attacks for WPA and WEP, automated hash cracking, bluetooth hacking and much more. I recommend you my alfa adapter: Alfa AWUS036ACM , which works really great with both, 2.4 and 5 Ghz Tested and supported in...
Should it transfer underSpentAmount to _msgSender() instead of reserve?
Lines of code Vulnerability details Impact underSpentAmount is dust amount, if being transferred to reserve without any state modification. These tokens might be lost. Normally, dust amount must transfer back to only msgSender as a best practice. Proof of Concept unchecked uint256 underSpentAmoun...
Multi-hop routes will leave a dust trail
Lines of code Vulnerability details Impact By calling RubiconMarket.buyid, quantity as a consequence of L239 and L241 with quantity = currentAmount - currentAmount expectedMarketFeeBPS / 10000 ...the fee calculated by the buy function amounts to: currentAmount - currentAmount expectedMarketFeeBPS...
Users can grief reward distribution
Lines of code Vulnerability details Impact Users can grief reward distributions by spending dust Proof of Concept If a reward is targeted for an epoch in the past, a user can front-run the txn in the mempool and call addRewardToEpoch with a dust amount at an epoch after the one in question. This...
TimeswapPair.sol#borrow() Improper implementation allows attacker to increase pool.state.z to a large value
Handle WatchPug Vulnerability details In the current implementation, borrow takes a user input value of zIncrease, while the actual collateral asset transferred in is calculated at L319, the state of pool.state.z still increased by the value of the user's input at L332. Even though a large number...
Dust Token Balances Cannot Be Claimed By An admin Account
Handle leastwood Vulnerability details Impact Users who have a small claim on rewards for various promotions, may not feasibly be able to claim these rewards as gas costs could outweigh the sum they receive in return. Hence, it is likely that a dust balance accrues overtime for tokens allocated f...
Epoch may rounded to zero in deposit depositRewardTokens and takeOutRewardTokens
Handle jonah1005 Vulnerability details division bias in deposit depositRewardTokens and takeOutRewardTokens Impact When the owner deposits reward into the contract, the remainder would not be counted. These dust tokens would be left in the contract. There's a similar issue in takeOutRewardTokens...
CVE-2021-41593
Lightning Labs lnd before 0.13.3-beta allows loss of funds because of dust HTLC exposure...
CVE-2021-41591
ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure...
CVE-2021-41591
ACINQ Eclair before 0.6.3 allows loss of funds because of dust HTLC exposure...
