Malicious code in eth-brownie (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7db0964a5c4a1b7436c8222bd442b65fab875a799d6377abad8376fe090d6c7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2860 Malicious code in eth-brownie (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7db0964a5c4a1b7436c8222bd442b65fab875a799d6377abad8376fe090d6c7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eth-balance-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5262abe8a739e9f893b3a0f9ce010d19304358cb843873f597ff90d79d619ccb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2859 Malicious code in eth-balance-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5262abe8a739e9f893b3a0f9ce010d19304358cb843873f597ff90d79d619ccb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eth-faucet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d45d0fcc70a2f4b7ac570e7c8b43ed635a5573e134e575405ecc70d94c7588f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2861 Malicious code in eth-faucet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d45d0fcc70a2f4b7ac570e7c8b43ed635a5573e134e575405ecc70d94c7588f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ETH funds accidentally sent to InfinityStaker cannot be retrieved

Lines of code Vulnerability details rescueETH function that aims to retrieve mistakenly sent funds cannot reach contract balance, only sending over the Ether value attached to the current call instead. Setting the severity to medium as the case is a violation of system's auxiliary logic. Also, an...

Rescue ETH at InfinityStaker.sol is incorrectly implemented

Lines of code Vulnerability details Impact Admins are unable to recover any ETH locked in the contract PoC The function rescueETHInfinityStaker.sol is incorrectly implemented. It is using msg.value instead of the balance of the contract /// @dev Admin function to rescue any ETH accidentally sent ...

Overpaying ETH in InfinityExchange

Lines of code Vulnerability details Impact A user of the InfinityExchange contract can accidentally send more ETH than needed without the possibility to get the overpaid amount refunded. Proof of Concept if isMakerSeller && currency == address0 requiremsg.value = totalPrice, 'invalid total price'...

Ether can get lock on functions takeMultipleOneOrders and takeOrders

Lines of code Vulnerability details Impact Ether send by the user cang gets locks when taking order/s Proof of Concept If Bob use function takeMultipleOneOrders or takeOrders to buy and sends more ETH that it supposes to remaing ETH will be lost, also if the seller is selling for other token and...

ETH rescue does not work

Lines of code Vulnerability details Impact Both contracts InfinityExchange and InfinityStaker have a function rescueETH to allow an admin to rescue any ETH accidentally sent to the contracts. However, this ETH rescue functionality does not work. The code expects ETH to be sent to this function an...

Accumulated ETH fees of InfinityExchange cannot be retrieved

Lines of code Vulnerability details ETH fees accumulated from takeOrders and takeMultipleOneOrders operations are permanently frozen within the contract as there is only one way designed to retrieve them, a rescueETH function, and it will work as intended, not being able to access ETH balance of...

Owner cannot transfer ETH balance of the exchange

Lines of code Vulnerability details User called takeOrders and takeMultipleOneOrders functions accumulate native token fees over time. These fees end up being frozen on the contract balance. There is only one way for an owner to transfer them, a rescueETH function, that isn’t able to access ETH...

rescueETH function doesn't works as expected

Lines of code Vulnerability details Impact The rescueETH function is implemented to collect any unexpected ETH transferred to the infinityExchange.sol contract, But this function will not work as expected. The function is supposed to return the eth from the contract to the specified destination...

Accidental ETH transfers to InfinityStaker cannot be withdrawn

Lines of code Vulnerability details The rescueETH function is meant to allow the contract owner to withdraw ETH accidentally sent to the contract. However, it will forward the exact ETH amount sent by the caller to the given destination address, rather than withdraw ETH from the contract balance:...

Upgraded Q -> M from 155 [1655579831823]

Judge has assessed an item in Issue 155 as Medium risk. The relevant finding follows: ETH send return value is ignored while is gas limited The use of send / call to send ETH may have unintended outcomes on the eth being sent to the receiver. Eth may be irretrievable or undelivered if the...

Upgraded Q -> M from 44 [1655579898351]

Judge has assessed an item in Issue 44 as Medium risk. The relevant finding follows: 1. Usage of legacy ETH transfer function Risk Low Impact Contract ForgottenRunesWarriors for withdrawing ETH to vault uses send function, which has a fixed gas stipend and can fail. The reason behind this is that...

YearnCurveVaultOperator's depositETH can leave the remainder ETH funds frozen and unaccounted for, then utilized by another caller

Lines of code Vulnerability details depositETH effectively do not control the utilization of input token and can freeze WETH input funds in native ETH form on the contract balance when Yearn pool doesn't perform liquidity addition for any reason. Due to presence of the additional WETH - ETH step,...

Upgraded Q -> M from 180 [1655579854185]

Judge has assessed an item in Issue 180 as Medium risk. The relevant finding follows: Use of send might fail in the future send only forward 2300 gas which may break when gas cost change in a future ETH upgrade see: function withdrawAll public payable onlyOwner...

receive function is unrestricted

Lines of code Vulnerability details Impact The receive function has not placed any restriction which means if any user accidentally sends any ETH to this contract then it is permanently freezed until timelock decides to release it by creating and approving a new transaction on timelock which...