# Potential unbounded loops in JBTiered721DelegateStore

Lines of code Vulnerability details Impact Multiple loops in JBTiered721DelegateStore are iterating over maxTierIdOf for a nft address. This value is incremented when calling recordAddTiers. The contract doesn't seem to have a functionality for decreasing this value. Proof of Concept Over time...

LBPair swap() can be front-runned, a malicious attacker can call swap with higher gas than a user, getting the user swap amount transferred to the attacker address

Lines of code Vulnerability details Impact In the LBPair.sol contract, when a user calls swap after transferring tokens to the Pair, a malicious attacker can front-run that tx then call swap on the same pair with the parameter to changed to an malicious address of his choice, paying a higher gass...

TokenHelper.sol#L40 : safeTransfer will revert due to insufficient gas.

Lines of code Vulnerability details Impact I am adding as high issue since most of the calling is done using the safeTransfer TokenHelper.solL40 : safeTransfer will revert due to insufficient gas. All the fuctions that are using the safeTransfer could fail due to insufficient gas. I see the...

Gas, a positive social network for teens (no, really)

A new social network is currently in the news, billed as a positive space for teens to enjoy themselves. Im all for positive spaces online, but what is it, and will teens really be happier there than say Instagram, or even just hanging out in WhatsApp groups? Pump the gas Launched in August of th...

Upgraded Q -> M from 400 [1666366548697]

Judge has assessed an item in Issue 400 as Medium risk. The relevant finding follows: Use address.call instead of payable.transfer Avoid use of transfer to send ether since transfer sends a fixed amount of gas and future gas cost change may cause revert, The receiving contract will also revert if...

Iterations over all tiers in recordMintBestAvailableTier can render system unusable

Lines of code Vulnerability details Impact JBTiered721DelegateStore.recordMintBestAvailableTier potentially iterates over all tiers to find the one with the highest contribution floor that is lower than amount. When there are many tiers, this loop can always run out of gas, which will cause some...

Upgraded Q -> M from 696 [1666361742731]

Judge has assessed an item in Issue 696 as Medium risk. The relevant finding follows: L05 - Usage of trasfer over call to send Ether could cause unexpected Reverts payablepayAddress.transferpayAmt; // royalty transfer to royaltyaddress The function payEther sends ether via transfer which passes a...

Upgraded Q -> M from 336 [1666364078201]

Judge has assessed an item in Issue 336 as Medium risk. The relevant finding follows: Using transfer For Sending Ether Permalinks Description The transfer and send functions forward a fixed amount of 2300 gas. Historically, it has often been recommended to use these functions for value transfers ...

Oil and Gas Cybersecurity: Trends & Response to Survey

Based on our survey of over 900 ICS security leaders in the United States, Germany, and Japan, we dig deeper into each industry's challenges and present Trend Micro's recommendations...

The buyer will lose their funds by "gas limit DoS via unbounded operations"

Lines of code Vulnerability details Impact If the buyer invoke execute he will lose their funds by gas limit DoS via unbounded operations Proof of Concept execute == executeFundsTransfer == transferFees In case, execute is called by the buyer ,and the seller set fees.length == 2^256-1 As we see...

Standard policy price matching is flawed

Lines of code Vulnerability details Impact Already placed orders may be highly unlikely able to be matched and executed. An order has to be created specifically for an already existing order with the intent to match and execute it. This severely impedes the functionality of the exchange, wastes...

Transfer reminder of msg.value is bad practice

Lines of code Vulnerability details Impact Transfer reminder of msg.value is bad practice. Can lead to out of gas, reentrancy and so on. Proof of Concept Tools Used Static analytics Recommended Mitigation Steps Can create method getReminder and user to call to get all reminders for him. --- The...

Upgraded Q -> M from 182 [1664281111530]

Judge has assessed an item in Issue 182 as Medium risk. The relevant finding follows: L00: Usage of transfer to send eth The transfer function has a fixed gas stipend of 2300. If a contract as well as EOA can call the function, it is advised to use call function instead of transfer. Here are...

The requestRandomSeed() function can be manipulated

Lines of code Vulnerability details Impact The task of the requestRandomSeed function works in ArtGobblers.sol for Request a new random seed from ChainlinkV1. There is a working rule: Can only be called every 24 hours at the earliest To make the requestRandomSeed function run every 24 hours; The...

Use of transfer() instead of call() to send eth

Lines of code Vulnerability details Use of transfer instead of call to send eth Impact Use of transfer might render ETH impossible to withdraw because after istanbul hardfork, there is increases in the gas cost of the SLOAD operation and therefore breaks some existing smart contracts.Those...

An attacker taking over the timelock_address or the owner address will result in DoS and unusable contract (frxETHMinter).

Lines of code Vulnerability details Impact Actions described in the POC result in DoS, if an attacker takes over one of the two "admin" addresses. Proof of Concept By taking over the timeLock or the owner address, the attacker will have access to the following functions moveWithheldETH,...

depositEther function DoS with locking funds

Lines of code Vulnerability details Description There is a depositEther function in frxETHMinter contract. The function performs multiple deposits to the depositContract. More detailed, the contract calculates the amount of ether that was submitted to it, and everything, except withheld amount, i...

CVE-2022-36025

Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in...

CVE-2022-39242

Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can constru...

Design/Logic Flaw

Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can constru...