595 matches found
M-06 Unmitigated
Lines of code Vulnerability details Original Issue code-423n4/2023-06-angle-findings13 Details This issue shows users may lose a portion of yield when protocolSafetyFee and vestingPeriod are changed. As mitigation, it recommends accruing interests before those parameters are changed. Mitigation P...
Malicious claimer could arbitrage the prize-claiming functionality
Lines of code Vulnerability details Impact The feePerClaim is a user controlled parameter which tops at tierLiquidity.prizeSize for a given tier see here for that. That means the CLAIMER can set arbitrary fees for a given call to claimPrize to increase maliciously the collected fees with //...
Vault.mintYieldFee FUNCTION CAN BE CALLED BY ANYONE TO MINT Vault Shares TO ANY RECIPIENT ADDRESS
Lines of code Vulnerability details Impact The Vault.mintYieldFee external function is used to mint Vault shares to the yield fee recipient. The function is an external function and can be called by anyone since there is no access control. The function will revert only under following two...
IF THE UNDERLYING ASSET IS A FEE ON TRANSFER TOKEN IT COULD BREAK THE INTERNAL ACCOUNTING OF THE VAULT
Lines of code Vulnerability details Impact The Vault.deposit function is used by the users to deposit assets to the vault and mint vault shares to the recipient address. The amount of assets are transferred to the Vault as follows: SafeERC20.safeTransferFrom asset, caller, addressthis,...
_totalWithdrawn VALUE DOES NOT INCLUDE THE _fee AMOUNT THUS INTRODUCING ACCOUNTING ERROR
Lines of code Vulnerability details Impact In the PrizePool.ClaimPrize function is used to claim the rewards of the verified winner. Here when sending the Prize amount to the winner a fee amount is deducted from it as shown below: uint256 amount = tierLiquidity.prizeSize - fee; And this amount is...
CVE-2023-3599
A vulnerability was found in SourceCodester Best Fee Management System 1.0. It has been rated as critical. Affected by this issue is the function saveuser of the file adminclass.php of the component Add User Handler. The manipulation leads to improper access controls. The attack may be launched...
CVE-2023-3599 SourceCodester Best Fee Management System Add User admin_class.php save_user access control
A vulnerability was found in SourceCodester Best Fee Management System 1.0. It has been rated as critical. Affected by this issue is the function saveuser of the file adminclass.php of the component Add User Handler. The manipulation leads to improper access controls. The attack may be launched...
CVE-2023-3599
SourceCodester Best Fee Management System 1.0 is affected by CVE-2023-3599 in the function save_user of admin_class.php (Add User Handler). The issue enables improper access controls and can be exploited remotely; multiple sources indicate the exploit has been disclosed publicly. Constraints vary...
PT-2023-25406 · Sourcecodester · Sourcecodester Best Pos Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Best Fee Management System version 1.0 Description: A critical issue has been found, affecting the function save user of the file admin class.php in the component Add User Handler. This leads to improper access controls, allowi...
Best Fee Management System 权限许可和访问控制问题漏洞
Best Fee Management System is a fee management system by Mayuri K. Individual developer. Best Fee Management System version 1.0 has a permissions licensing and access control issue vulnerability that stems from the saveuser function in the adminclass.php file that results in incorrect access...
Well.sol::swapFrom() Missing Fee-on-Transfer Token Check
Lines of code Vulnerability details Description The swapFrom in the Well.sol contract does not include a check for fee-on-transfer tokens, as specified in the Nespac. The comment states that the check for fee-on-transfer tokens is performed in the setReserves, but checks are not implemented in th...
Well.sol contract allows anyone to add liquidity to tokens with fee-on-transfer by calling the addLiquidity function
Lines of code Vulnerability details Impact A malicious user can call the wrong function for adding liquidity for a pair with fee-on-transfer tokens. The reserves information maintained within the contract suffers from an inconsistency which can result in various miscalculations for liquidity...
Well.sol::addLiquidity() Unauthorized Liquidity Addition for Fee-on-Transfer Tokens
Lines of code Vulnerability details Description The addLiquidity in the Well.sol contract allows any address to add liquidity to tokens with a fee-on-transfer mechanism. Although there is a another function available to add liquidity for Fee-on-transfer token name addLiquidityFeeOnTransfer. Howev...
the swapFrom() function allows the Fee On Transfer tokens and _setReserves doesn't revert
Lines of code Vulnerability details Impact the protocol supports the fee on transfer tokens and has implemented a special capable function for it and wants to not allow and revert the fee on transfer tokens in normal SwapFrom function as it says in comments of swapfrom function @dev MUST revert i...
Decimal is not correct in fee calculation
Lines of code Vulnerability details Impact The decimal doesn't match in the fee calculation, so this will break the fee calculation. Since fee calculation is very important in Mint/Burn actions, this problem can ruin the core functionality of transmuter. Proof of Concept This is the non-exact min...
An attacker can burn shares of other users by calling executeFlashloan()
Lines of code Vulnerability details The executeFlashloan in PeUSDMainnetStableVision.sol allows users to execute flash loans but the problem is that the receiver doesnt have to be the msg.sender so an attacker can do 2 things: 1. Execute other users flash loans 2. If a user is a smart contract th...
[H] Eth remains stuck in contract due to reversion in convertToPeUSD
Lines of code Vulnerability details Impact ETH sent with this call will not be refunded to the caller upon revert. Proof of Concept Due to a discrepancy in the convertToPeUSD function where the call to mintVault implemenation from transferFrom is non-existent, the subsequent call to...
Incorrect poolTotalEUSDCirculation Calculation
Lines of code Vulnerability details Impact poolTotalEUSDCirculation calculated incorerctly so it can effect reward distribution Proof of Concept The following line of code deduces repaid amount from poolTotalEUSDCirculation while the fee that is part of repaid amount will be distribute as rewards...
