Malicious code in sui-lending-protocol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e6570f41c53bce293ad4b3bea99d8f2ed4c76e5fb5208785bdaf221dcfbe5d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2528 Malicious code in sui-lending-protocol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e6570f41c53bce293ad4b3bea99d8f2ed4c76e5fb5208785bdaf221dcfbe5d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Multiple addresses can point to the same cidNFTID

Lines of code Vulnerability details Impact During AddressRegistry.register there is no check to ensure that a cidNFTID has been registered to an address. As CID NFT is transferrable, this means that the same CID NFT can be registered by multiple addresses. This could cause troubles for Dapps that...

Hardcoded prices are subject to be abused

Lines of code Vulnerability details Impact Hardcoded prices are subject to be abused which might address the protocol being drained. Proof of Concept There are 2 possible different issues of the Lending Protocol; 1. The attack surface/risk is not originated directly through the Canto protocol but...

Sudden price fluctuations occuring at a call to _update() will not be reflected by reserves(), sampleReserves() and sampleSupply() until after periodSize seconds

Lines of code Vulnerability details Impact Consider the situation where a token suddenly drops drastically in price in the market. Consider a call to BaseV1Pair.swap which makes a very large swap between the two tokens accurately reflecting the change in price and also causes a new observation to...