Unable to release funds deposited through Lock-extendLock

Lines of code Vulnerability details Impact Users depositing tig assets to the bondNFT through the Lock contract could find themselves unable to release their funds. The only explanation the user would receive is an "Arithmetic over/underflow" error. This issue greatly deteriorates the user...

user's funds lock and incorrect code behavior because users withdrawal amount won't get reset for all users in each userPeriodLength in WithdrawHook contract

Lines of code Vulnerability details Impact according to the comments in code: "Every time userPeriodLength seconds passes, the amount withdrawn for all users will be reset to 0" . but in current implementation only one of the users userToAmountWithdrawnThisPeriod value gets reset and this will...

Router can perform swaps, add/remove liquidity to pools that do not belong to the protocol.

Lines of code Vulnerability details Impact Users can lose their funds PoC In UniswapV3 decodeFirstPool returns the tuple address tokenOut, address tokenIn, uint24 fee . From there it lookups the corresponding pool address with getPooltokenIn, tokenOut, fee which may not exist. See However, in you...

A whale user is able to cause freeze of funds of other users by bypassing withdraw limit

Lines of code Vulnerability details Description In Collateral.sol, users may withdraw underlying tokens using withdraw. Importantly, the withdrawal must be approved by withdrawHook if set: function withdrawuint256 amount external override nonReentrant uint256 baseTokenAmount = amount...

Attackers Keep Targeting the US Electric Grid

Plus: Chinese hackers stealing US Covid relief funds, a cyberattack on the Met Opera website, and more...

Possible malicious _uri in initialize() of Escher721.sol

Lines of code Vulnerability details Impact Loss of user funds if user approves malicious transaction Description Trace: createContract of Escher721.Factory.sol calls initialize of Escher721.sol The initialize function sets tokenUriDelegate to the passed in uri address. There's no input validation...

Funds reserved for refunding users can be steal in LPDA sale

Lines of code Vulnerability details Impact LPDA sale works like a Dutch Auction, where early buyers will get refund after the sale ended. In addition, in buy function, when last NFT is saled, it is automatically ending the LPDA sale and send payments to sale receiver, fee to fee receiver. And the...

double user token spending in function executeBuyWithCredit() contract transfer user wETH fund for wETH orders even when user send payment as ETH to contract and contract converted it to wETH (_depositETH() and _delegateToPool() takes user funds when user sends ETH and tries to buy WETH order)

Lines of code Vulnerability details Impact when user wants to buy NFT tokens with wETH asset, and he/she sent ETH to executeBuyWithCredit or executeBatchBuyWithCredit, code would take user tokens two times, one as ETH token in depositETH and one as wETH tokens in delegateToPool so users would pay...

If very few NFTs have been sold saleReceiver will have to buy all remaining NFT to retrieve the contract funds.

Lines of code Vulnerability details Impact If very few NFTs have been sold saleReceiver will have to buy all remaining NFTs if he want to get the funds that he obtained during the mint period. Fortunately, It is still possible to mint NFT after temp.endTime because the following check is not done...

LPDA.sol and FixedPrice.sol will lock the funds forever

Lines of code Vulnerability details Impact Possibility of IDs collision The ether will be locked on FixedPrice or LPDA Proof of Concept On the same Escher721 Let’s say the first collection start from id = 0 and end on id = 10 So the next collection of the same Escher721 We can say the next part o...

Anyone can call addLiquidity function and be the router

Lines of code Vulnerability details Impact Anyone can call addLiquidity, meaning that when IAddLiquidityCallbackmsg.sender.addLiquidityCallbacktokenAAmount, tokenBAmount, data; is called, the msg.sender can be a contract that a malicious user has deployed and has a addLiquidityCallbacktokenAAmoun...

DEV-0139 launches targeted attacks against the cryptocurrency industry

Over the past several years, the cryptocurrency market has considerably expanded, gaining the interest of investors and threat actors. Cryptocurrency itself has been used by cybercriminals for their operations, notably for ransom payment in ransomware attacks, but we have also observed threat...

Fake Windows Crypto Apps Spreading AppleJeus Malware

By Deeba Ahmed The infamous North Korean state-backed Lazarus hacking group is using AppleJeus malware to steal crypto funds from Windows users. This is a post from HackRead.com Read the original post: Fake Windows Crypto Apps Spreading AppleJeus Malware...

setRelayer function not checking for null relayer address

Lines of code Vulnerability details Summary When calling the setRelayer function with a null relayer address, the function does not check for this and allows the address to be set. This issue can cause the contract to fail when calling the executeCalls function and potentially cause loss of funds...

Funds may be lost if processCalls is called from a contract

Lines of code Vulnerability details Impact In CrossChainRelayerArbitrum.processCalls, msg.sender is set as the address to receive any refund both excess fee refund and call value refund in the createRetryableTicket call. Arbitrium credits the refunded value to L2 balance, so if the user doesn't...

Nonce not properly checked in CrossChainExecutorArbitrum contract

Lines of code Vulnerability details Summary The CrossChainExecutorArbitrum contract does not properly check the nonce before executing calls. This allows a potential attacker to replay a batch of calls that have already been executed. Impact If a batch of calls is replayed, it could result in...

Potential reentrancy attack

Lines of code Vulnerability details Impact There is a potential of reentrancy attack in executeCalls in EthereumToArbitrumExecutor.sol since CallLib is making an external call with its executeCalls and we do not know the implementation of the contract that will be called eventually. The same issu...

Code is vulnerable to ERC4626 first depositor shares manipulation exploit

Lines of code Vulnerability details Proof of Concept The normal ERC4626 implementation which is not changed in the repository has a vulnerability which can result in the first depositor stealing every subsequent depositor’s funds. It works like this: 1. Vault is just deployed and Bob deposits jus...

Reentrancy potential

Lines of code Vulnerability details Impact A reentrancy attack could be performed and can result in exploit and losing funds Proof of Concept Tools Used Manual review Recommended Mitigation Steps Use nonReentrant modifier imported from solmate/utils/ReentrancyGuard.sol --- The text was updated...

Price manipulation can lead to users lossing funds

Lines of code Vulnerability details H Price manipulation can lead to users lossing funds Impact Early malicious user will profit from future users' deposits while future users' will loose funds/value. Proof of Concept An early user can call the deposit function of any of the ERC4626 vaults with...