MAL-2023-493 Malicious code in hardhat-web3-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 736287dd58e487359e35a7c53653af7140c45ca2919d533e02fb45b58e898dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-492 Malicious code in hardhat-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9ecd6650e933188001d304f60e4bdc5a7820065595396fe796ba8d86eb3bda7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hardhat-manage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c715606ed1f31065a073bcd5c09d01c86c31360cb2c2f583f93d5896dc06f188 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-491 Malicious code in hardhat-manage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c715606ed1f31065a073bcd5c09d01c86c31360cb2c2f583f93d5896dc06f188 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Lendgine contract can be drained through mint() function due to lack of Access Control

Lines of code Vulnerability details Impact Anybody can call the mint function on lendgine.sol and enter any amount of collateral. This allows them to mint any number of tokens to their address for free. Proof of Concept The mint function in lendgine.sol is external with no additional modifiers or...

Baited by redemption during undercollateralization (no issuance, just transfer)

Lines of code Vulnerability details Impact This is similar to the "high" vulnerability I submitted, but also shows a similar exploit can be done if a user isn't a whale, and isn't issuing anything. A user can send a redeem TX and an evil actor can make it so they get almost nothing back during...

An attacker can create a smart contract wallet with a malicious config and the address that the user expects his smart contract to have

Lines of code Vulnerability details Issue A deployCounterFactualWallet function in the SmartAccountFactory.sol uses create2 command to deploy a smart contract wallet with the address that can be computed before a transaction. A problem with the function is that it doesn't include the config...

MAL-2022-3561 Malicious code in hardhat-modern (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 364a19411c6fa78338bfd1eb9f6987f560554219e531430448430f84c4ecb947 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hardhat-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d413678735916efe26eb4cd4c106907b9e0fdce0f0bd3c41706a4a64e9b9139 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hardhat-modern (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 364a19411c6fa78338bfd1eb9f6987f560554219e531430448430f84c4ecb947 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3560 Malicious code in hardhat-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d413678735916efe26eb4cd4c106907b9e0fdce0f0bd3c41706a4a64e9b9139 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4662 Malicious code in modern-hardhat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96c131c39f2ccb7fe9bbb345454bfd7e287a9e8f2340eab60bb225d75be91833 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in modern-hardhat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96c131c39f2ccb7fe9bbb345454bfd7e287a9e8f2340eab60bb225d75be91833 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

execute does not work for ERC1155 tokens orders where amount > 1

Lines of code Vulnerability details Impact StandardPolicyERC1155 functions canMatchMakerBid and canMatchMakerBid always return amount == 1, regardless of the function arguments. This means that calling execute on an agreed order of ERC1155 token with an amount 1 will always transfer amount == 1 o...

Multiple storage slot collisions between versions - due to different order in declaration

Lines of code Vulnerability details Impact If we list the sequence of how variables receive slots, we will see the failure to follow "append-only" principle. Many variable added "in-between" V2 version can read/write wrong slots. Proof of Concept Here is the table/list of variable, built taking...

Malicious Package

Overview hardhat-cover is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

interest rate calculate vulnerability

Lines of code Vulnerability details Impact function addinterst uses the interest rate immediately generated by the current block first transaction calculated,it will cause some interest lose. Proof of Concepmt function addinterst uses the interest rate immediately generated by the current block t...

Registry.sol works bad - it fails to delivere expected functionality

Lines of code Vulnerability details Impact The description of Registry.sol is following: /// Deploys new proxies via the factory and keeps a registry of owners to proxies. Owners can only /// have one proxy at a time. But it is not. There are multiple problems: 1. Proxy owner can change and will...

[PNM-002] The expiry of the parent node can be smaller than the one of a child node, violating the guarantee policy

Lines of code Vulnerability details Description By design, the child node's expiry can only be extended up to the parent's current one. Adding these restrictions means that the ENS users only have to look at the name itself's fuses and expiry without traversing the hierarchy to understand what...

State Variable Shadowing

Lines of code Vulnerability details Impact Check: shadowing-state Severity: High Confidence: High It is possible to use the same variable twice in Solidity, but it can lead to unintended side effects.The TestAllowance.sol contract inherits from TesTBaseWorkflow.sol. In the TestAllowance.sol...