SSRF Flaw in Fintech Platform Allowed for Compromise of Bank Accounts

A server-side request forgery SSRF flaw in an API of a large financial technology fintech platform potentially could have compromised millions of bank customers, allowing attackers to defraud clients by controlling their bank accounts and funds, researchers have found. A team at Salt Security’s...

NonCustodialPSM can become insolvent as CPI index rises

Lines of code Vulnerability details Impact NonCustodialPSM mints and redeems VOLT to a chosen stablecoin at the current market rate minus a fixed fee. It is assumed that the difference to be covered with pcvDeposit funds. That assumption is similar to one used in FEI protocol, but there no rate...

Whole balance self transfer set user's cooldown to zero

Lines of code Vulnerability details Impact If a user transfers to self the whole balance, then user’s cooldown resets to zero. A user will have to reset its cooldown manually to current timestamp via cooldown call to be able to unstake in the future. As a transfer to self can happen by mistake an...

Cooldown tricking possible

Lines of code Vulnerability details Impact Due to an approach that upon a transfer the weighted average is calculated for the cooldown, it is possible to trick it in a way that ready funds can "thrive" in the allowed window, ready to payout. Anytime it is ending, those funds can be "mixed" with...

[WP-H11] lender may not be able to get back their funds, due to improper handling of potential loss of strategy

Lines of code Vulnerability details uint256 notBorrowed = pooledCLConstantsid.borrowLimit.subPOOLEDCREDITLINE.getPrincipalid; uint256 notBorrowedInShares = IYieldstrategy.getSharesForTokensnotBorrowed, borrowAsset; uint256 sharesHeld = pooledCLVariablesid.sharesHeld; requiresharesHeld != 0,...

[WP-H1] LenderPool.sol#terminate() Wrong value is used for the shares argument of SAVINGS_ACCOUNT.withdrawShares() can cause fund loss to all users

Lines of code Vulnerability details / @notice Function invoked when pooled credit line is terminated by admin @dev only pooledCreditLineContract can invoke @param id identifier for the pooled credit line @param to address to which all the borrow tokens are transfered / function terminateuint256 i...

[WP-M11] Wrong implementation of DexManagerFacet.sol#batchRemoveDex() will remove only the first item

Lines of code Vulnerability details function batchRemoveDexaddress calldata dexs external LibDiamond.enforceIsContractOwner; for uint256 i; i dexs.length; i++ if s.dexWhitelistdexsi == false continue; s.dexWhitelistdexsi = false; for uint256 j; j s.dexs.length; j++ if s.dexsj == dexsi removeDexj;...

[WP-H6] Swapper can be used to steal all the funds from the contract

Lines of code Vulnerability details function swapTokensGenericLiFiData memory lifiData, LibSwap.SwapData calldata swapData public payable uint256 receivingAssetIdBalance = LibAsset.getOwnBalancelifiData.receivingAssetId; // Swap executeSwapslifiData, swapData; uint256 postSwapBalance =...

Reliance on lifiData.receivingAssetId can cause loss of funds

Lines of code Vulnerability details Impact In the swapTokensGeneric function, an arbitrary number of swaps can be performed from and to various tokens. However, the final balance that is sent to the user relies on lifiData.receivingAssetId which has no use in the swapping functionality. LifiData ...

Missing input validation could lead to loss of fund

Lines of code Vulnerability details Impact A faulty input in GenericSwapFacet.swapTokensGeneric could cause funds to get stuck in the contract. In addition, tokens left in the LiFi contract can be retrieved by anyone see issue: ERC20 withdrawals can be frontrun, leading to loss of fund. Proof of...

[WP-M10] Wrong formula of getSharesForAmount() can potentially cause fund loss when being used to calculate the shares to be used in withdraw()

Lines of code Vulnerability details In Collateral, the getter functions getAmountForShares and getSharesForAmount is using totalAssets instead of strategyController.totalValue, making the results can be different than the actual shares amount needed to withdraw a certain amount of baseToken and t...

DoS attack the system and steal all the users' funds

Lines of code Vulnerability details Impact That exploit is possible because of the implementation of the deposit function of the SingleStrategyController contract. // Assumes approval to take amount has already been given by vault function deposituint256 amount external override onlyVault...

Can deposit native token for free and steal funds

Lines of code Vulnerability details Impact The depositErc20 function allows setting tokenAddress = NATIVE and does not throw an error. No matter the amount chosen, the SafeERC20Upgradeable.safeTransferFromIERC20UpgradeabletokenAddress, sender, addressthis, amount; call will not revert because it...

CVE-2022-24738

Evmos prior to v2.0.1 is vulnerable to draining unclaimed funds by an attacker who creates a malicious chain that does not enforce signature verification and connects it to a target Evmos instance via IBC, enabling migration of claim records and fund transfer. The issue stems from a vulnerability...

Schain owner dictate fund usage after kill

Lines of code Vulnerability details Impact After a schain is killed by both the owner and the IMA admin, schain admin can control all the fund using e.g. DepositBoxERC20.getFunds functions. This pose a significant centralization risk after the schain is killed. Proof of Concept function...

NFT Sellers Can Steal Funds if an Offer is Accepted on an Unfinalized Auction

Lines of code Vulnerability details Impact NFTs can be sold to users in a variety of ways. One main method is for a seller to auction their NFT by creating a reserve auction. Once the auction is active, it is guaranteed that the sale will go to the highest bidder. Once an auction has ended, anyon...

NFT owner can create multiple auctions

Lines of code Vulnerability details Impact NFT owner can permanently lock funds of bidders. Proof of concept Alice the attacker calls createReserveAuction, and creates one like normal. let this be auction id 1. Alice calls createReserveAuction again, before any user has placed a bid this is easy ...

Auction DOS On The Bidding

Lines of code Vulnerability details Impact During the code review, It has been observed that If the bidder is contract, the bidder can make auction infunctional. Proof of Concept 1. Navigate to the following contract. 2. Auction has public function named as placeBid. 3. Example Poc steps can be...

[WP-H7] InsuranceFund#syncDeps() may cause users' fund loss

Lines of code Vulnerability details function syncDepsIRegistry registry public onlyGovernance vusd = IERC20registry.vusd; marginAccount = registry.marginAccount; The Governance address can call InsuranceFund.solsyncDeps to change the contract address of vusd anytime. However, since the tx to set ...

Ownership of Swap.vy cannot be transferred

Lines of code Vulnerability details Impact Ownership transfer function of Swap.vy is commented out. Fund can be stuck if an AMM and governance change/upgrade is required. Proof of Concept --- The text was updated successfully, but these errors were encountered: All reactions...