If the length of owners in the safe array is too large, may experience out of gas revert

Lines of code Vulnerability details Proof of Concept Function requireSafesEquivalent in SecurityCouncilMgmtUpgradeLib.sol checks whether the addresses in the two safe arrays are the same and of the same length. If the arrays are too large, like there are many addresses that manages a gnosis safe,...

call() should be used instead of transfer() on an address payable

Lines of code Vulnerability details Impact The use of the transfer function for sending ETH to an address will inevitably make the transaction fail when: The claimer smart contract does not implement a payable function. The claimer smart contract does implement a payable fallback which uses more...

SETTING block.timestamp AS THE DEADLINE COULD LEAD TO HIGHER RATE OF FAILED TRANSACTIONS

Lines of code Vulnerability details Impact The OptionsPositionManager.swapExactTokensForTokens function is used to swap assets for exact assets. Here the exact amount of source token is swapped for an amount of target token. The function uses the IUniswapV2Router01.swapExactTokensForTokens call f...

Missing validation checks on sending non blocking LZ payload

Lines of code Vulnerability details Impact In OFTCoreV2 provided as example by LayerZero function sendaddress from, uint16 dstChainId, bytes32 toAddress, uint amount, address payable refundAddress, address zroPaymentAddress, bytes memory adapterParams internal virtual returns uint amount...

Attackers might be able to avoid calling reference modules when creating publications

Lines of code Vulnerability details Bug Description When comment, mirror or quote is called on a publication with a reference module, the reference module will be called. For example, when a user mirrors another publication with a reference module, the processMirror function of that reference...

[ H ] Infinite loop in calculateNewIndex prevents tokens from being minted and rewards from being distributed

Lines of code Vulnerability details Impact Recursive calls from calculateNewIndex in MultiRewardDistributor will result in an infinite loop and out of gas errors, preventing tokens from being minted and rewards being sent to some users as disburseSupplierRewardsInternal will not be called. Proof ...

Front-Running Vulnerability in LensHub.sol's commentWithSig and quoteWithSig Functions

Lines of code Vulnerability details Impact A vulnerability has been discovered in LensHub.sol's commentWithSig and quoteWithSig functions. This vulnerability potentially enables an attacker to disrupt users' actions by front-running transactions, resulting in undesirable modifications of comments...

Malicious actors could pass in huge arrays to disrupt service availability (DOS) in the updateVotingPower function

Lines of code Vulnerability details Impact The contract is stopped from being usable by legitimate users if the attacker repeatedly spammed large arrays Proof of Concept The updateVotingPower function currently only checks that the array is = 50: While 50 may be a reasonable limit for normal usag...

Batch function calls can use up all the gas and fail

Lines of code Vulnerability details Impact Every function call "targetsi.call" is going to store the response data in memory, although it is not stored in a variable. Storing the data requires gas and can use up all gas if the data is big enough. This risk increases exponentially since there is a...

[H] Users can lose their funds if the transaction reverts on destination chain

Lines of code Vulnerability details Impact The transmitSendToken function in the contract facilitates cross-chain token transfers. For contracts involving ERC20 tokens it is also expected that, should a contract call fail, one's tokens are not lost/transferred elsewhere. However, the function doe...

A whale can DoS the token service by reaching flowlimit

Lines of code Vulnerability details Impact Clients can't transfer tokens between chains because the flow limit is reached. Proof of Concept In FlowLimit.sol:addFlow, we revert if current flowToAdd + flowAmount flowToCompare + flowLimit: uint256 flowToAdd; uint256 flowToCompare; assembly flowToAdd...

Users who call expressReceiveTokenWithData or expressReceiveToken can griefed to pay for fees

Lines of code Vulnerability details Impact A user or service who calls expressReceiveTokenWithData or expressReceiveToken generally waits for an event associated with either callContractWithInterchainToken or sendToken to be emitted on a second chain. When they see this event, they will call...

Malicious USB Drives Targeting Global Targets with SOGU and SNOWYDRIVE Malware

Cyber attacks using infected USB infection drives as an initial access vector have witnessed a three-fold increase in the first half of 2023, That's according to new findings from Mandiant, which detailed two such campaigns – SOGU and SNOWYDRIVE – targeting both public and private sector entities...

In LSP6SetDataModule.sol, Infinite loop in _verifyAllowedERC725YDataKeys()

Lines of code Vulnerability details Impact In verifyAllowedERC725YDataKeys there is a great possibility of an Infinite loop. This is because ++ii is an increment inside if condition. This can lead to excessive gas consumption, causing the Ethereum transaction to fail due to the gas limit Proof of...

Claim failure can result to loss of funds

Lines of code Vulnerability details Impact Caller will lose funds through gas fees when claim fails Proof of Concept The claimPrize function allows any caller to claim a prize by providing the necessary parameters: winner address of the winner, tier prize tier, prizeIndex prize index,...

_getNextObservationIndex() Random use of timestamp to determine the currentTime can be manipulated bacause of dangerous strict equalities

Lines of code Vulnerability details Impact The use of strict equalities can be easily manipulated by an attacker. Miners may attempt to manipulate the timestamp. Proof of Concept File: TwabLib.sol Code Link: Code: if newestObservation.timestamp == currentTime File: TwabLib.sol Code Link: Code: if...

Malicious user may force gas limit error on created proposals

Lines of code Vulnerability details Impact User can create a proposal with arbitrary long array of targets. Function cancel iterates over those targets. Since this array may be long - the risk of out-of-gas error may occur - making the contract to be unable to cancel the proposal as cancel would...

Funds added to reserves through sync are accidentally transferred out to users

Lines of code Vulnerability details Impact Wells have the ability to shift funds to other Wells as part of gas-efficient multi-pool swaps. This natspec explanation of this can be find here. The sync function is intended to synchronize the underlying token amounts with the token reserves of the...

bad actore can increase gas usage in swapfrom function

Lines of code Vulnerability details Impact bad actor can increase gas in swapfrom function because everytime calling swapfrom function it store new unit and everytime runs the loop for length of it Proof of Concept the swapfrom function includes function setReservesIERC20 memory tokens, uint256...

[H] Eth remains stuck in contract due to reversion in convertToPeUSD

Lines of code Vulnerability details Impact ETH sent with this call will not be refunded to the caller upon revert. Proof of Concept Due to a discrepancy in the convertToPeUSD function where the call to mintVault implemenation from transferFrom is non-existent, the subsequent call to...