MarginAccount.sol - Asset transfer to insuranceFund is lost.

Lines of code Vulnerability details Impact MarginAccount.sol - Line 377, token asset is transferred into insuranceFund but not found any function to transfer asset out of insuranceFund. Proof of Concept Add any ERC20 token to Collateral list Call settleBadDebt Recommended Mitigation Steps Add...

admin can rug pull

Lines of code Vulnerability details In the links I provided, the admin can steal all user funds. this can cause reputation risk. --- The text was updated successfully, but these errors were encountered: All reactions...

Unsafe ERC20 transfers are used in BribeVault and ThecosomataETH

Lines of code Vulnerability details Impact For some ERC20 tokens no revert occurs but false is returned if transfer failed for any reason. If this isn't checked, the system will enter a wrong state with an accounted, but not executed transfer. Such effect can pile up, messing the logic altogether...

[WP-H4] Input should be validated on-chain to avoid fund loss caused by admin's misinput

Lines of code Vulnerability details In the current design/implementation, the admin of BribeVault is a super privileged role of the system. However, the inputs of the admin to some of the most critical methods are not being validated properly. This can lead to loss of funds to users caused by the...

safeConcurTransfer can cause loss of funds

Lines of code Vulnerability details Impact All calculations are rounded down, since a lack of tokens in the contracts cannot be rounding errors' fault. So the function is redundant. On the other hand, if the contract is undersupplied with Concur tokens, this will cause depositors to be sent less...

Shelter funds can be stolen

Lines of code Vulnerability details Impact Shelter has a function withdraw that lets whitelisted users withdraw a specified amount of some token. The function does not check if the user has already withdrew the tokens. Since, a user can withdraw allowed amount any number of times, stealing all th...

Owner can extend coolDownPeriod to indefinitely - Improper Upper Bound Definition on the coolDownPeriod

Handle defsec Vulnerability details Impact The setCoolDownTime function does not have any upper or lower bounds. Values that are too large will lead to reversions in several critical functions. User funds will be locked forever. Proof of Concept 1. Navigate to the following contract. function...

Unsafe ERC20 Operation(s)

Handle Czar102 Vulnerability details Impact ERC20 tokens may not revert on failure, instead return false. Users may lose their funds as ERC20 calls may fail. They are made to unknown ERC20 tokens that have no additional constraints on their failure reporting. Findings: LaunchEvent.sol::458 =...

[WP-H0] In the case of Single Asset Entry, new liquidity providers will suffer fund loss due to wrong formula of ΔRo

Handle WatchPug Vulnerability details Current Implementation When baseToken rebase up Per the document: and related code: Gamma is the ratio of shares received by the new liquidity provider when addLiquidity ΔRo to the new totalSupply total shares = Ro' = Ro + ΔRo. ΔRo = Ro/1 - γ γ Ro Gamma =...

[WP-H2] Transferring quoteToken to the exchange pool contract will cause future liquidity providers to lose funds

Handle WatchPug Vulnerability details In the current implementation, the amount of LP tokens to be minted when addLiquidity is calculated based on the ratio between the amount of newly added quoteToken and the current wallet balance of quoteToken in the Exchange contract. However, since anyone ca...

Denial of Service in Onionshare

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. - Vulnerability ID: OTF-012 - Vulnerability type: Denial of Service - Threat level: Moderate Description: The receive mode...

GHSA-JH82-C5JW-PXPC Denial of Service in Onionshare

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. - Vulnerability ID: OTF-012 - Vulnerability type: Denial of Service - Threat level: Moderate Description: The receive mode...

OTF-001: Improper Input Sanitation: The path parameter of the requested URL is not sanitized before being passed to the QT frontend

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-001 - Vulnerability type: Improper Input Sanitization -...

GHSA-W9M4-7W72-R766 Improper Access Control in Onionshare

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-004 - Vulnerability type: Improper Access Control - Threa...

Improper Access Control in Onionshare

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-009 - Vulnerability type: Improper Access Control - Threa...

Username spoofing in OnionShare

Between September 26, 2021 and October 8, 2021, Radically Open Security conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's Red Team lab. This is an issue from that penetration test. - Vulnerability ID: OTF-005 - Vulnerability type: Improper Input Sanitization -...

Anyone can freeze fund in BridgeMinter

Handle gzeon Vulnerability details Impact Anyone can call migrateETH and migrateLPT in L1Migrator with arbitrary maxSubmissionCost. For example when migrateLPT is called, it would withdraw all LPT from bridgeMinter, and then create a L2 retryable ticket to call the L2Migrator using...

[WP-H29] Vault#setController() owner of the Vault contracts can drain funds from the Vault

Handle WatchPug Vulnerability details function setControlleraddress controller public override onlyOwner requirecontroller != address0, "ERRORZEROADDRESS"; if addresscontroller != address0 controller.migrateaddresscontroller; controller = IControllercontroller; else controller =...

Race condition to withdraw funds

Handle pedroais Vulnerability details Impact Users may have to wait more time than predicted to withdraw funds. Proof of Concept The vault's funds are distributed between the vault and the investment strategy but withdrawals come only from funds that are currently inside the vault. This means tha...

Vault: Reduce reliance on manual rebalances from strategy to vault

Handle hickuphh3 Vulnerability details Impact Withdrawals are processed solely with funds that are held by the vault. Should there be insufficient liquidity Eg. many withdrawals in a short time, users have to rely on a trusted party operator to move funds from the investment strategy to the vault...