In CNote.sol, an attacker can DOS the money lending/debt repay functionalities for everybody

Lines of code Vulnerability details Impact Affected code: https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252...

Anyone can execute a proposal

Lines of code Vulnerability details Impact Anyone can call execute and pass in a malicious proposal. Proof of Concept There is no access control for the execute function. Tools Used Manual Review. Recommended Mitigation Steps Implement access control to execute. --- The text was updated...

BaseRate can be update by anyone

Lines of code Vulnerability details Impact There is no access modifier in updateBaseRate due to which, anyone can change Baserate to a very low value an borrow the large value function updateBaseRateuint newBaseRatePerYear public Proof of Concept Tools Used manual review Recommended Mitigation...

cause an attacker to get a better deal on intrest rate on borrwoing and lending or cause txs' to revert

Lines of code Vulnerability details Impact if the variable maturity in getMaturity function is a big number that gets put into uint40 and since its to big of a number it will revert because solidity ^0.8.0 dosn't allow overflow and on deployment hasMatured can be true because it very close to the...

cause users to revet right after deployment so they cant lend or borrow

Lines of code Vulnerability details Impact because of deployment hasMatured is false mintInternal reverts then cause users' to loose money on gas and users' cant lend which could lead to worse things and cause more attack vectors. Recommended Mitigation Steps check for delay after deployment or g...

Lack of Limit on amount Allows Borrowers To Be Extorted For Interest Payments

Lines of code Vulnerability details Impact There is on limit on the upper bounds on the amount a lender may send to a borrower. Borrowers will then be forced to pay interest and facilitators fee on the full amount loaned. The impact for a borrower is that they may be forced to repay significantly...

Borrower collateral can be stolen

Lines of code Vulnerability details Impact In case of collateral price fluctuation, lender can create a situation where borrower would be unable to repay the loan and lender could get hold of collateral Proof of Concept 1. User creates a loan request for duration 1 day and minimum amount as 0.1...

Missing allowlist checks on tokens in CrossAnchorBridge could cause loss of funds

Lines of code Vulnerability details Impact The CrossAnchorBridge contract accepts any ERC20 token and transfers them to the wormhole bridge. There were allowlist checks on the tokens before, but they were commented out in this version for the audit. If a user transfers, for example, non-supported...

Cannot use most piecewise linear functions with current implementation

Handle cmichel Vulnerability details The ThreePieceWiseLinearPriceCurve.adjustParams function uses three functions f1, f2, f3 where yi = fixi. It computes the y-axis intersect b2 = f20, b3 = f30 for each of these but uses unsigned integers for this, which means these values cannot become negative...

Lending Pair initialize function can be front run.

Handle jonah1005 Vulnerability details Impact LendingPair does not initialize tokenMaster, controller, tokens. A hacker can listen the deployer address and front run the initialize transaction. The initialized contract would look almost exactly the same if the hacker only replace lpTokenMaster wi...

Griefing lenders

Handle gpersoon Vulnerability details Impact Suppose there are several lenders for token B of a pair. And an attacker puts in a deposit for token A to the maximum possible amount via accountA. And an attacker puts in a deposit for token B to the maximum possible amount via accountB. And then lend...

Incorrect AsymmetricShare calculation in Utils.sol

Handle 0xRajeev Vulnerability details Impact The calcAsymmetricShare function is supposed to calculate the numerator as: share = u U 2 A^2 - 2 U u + U^2/U^3 which can be considered as part1 part2 - part3 + part4 / part5 according to the code comments. However the formula for part1, part2 and part...

Stable Yield Credit Security Breach

Stable Yield Credit is a new protocol for decentralized lending, stablecoin, and automated market maker AMM in one for the Stable Yield Credit community. Stable Yield Credit suffers from a security vulnerability that stems from certain miscalculations in the deposit function. An attacker could...

SQL Injection Vulnerability in elib, the Book Lending Management System of Qixing Company (CNVD-2020-73421)

Qixing book lending system is a book lending management system, including the front and back office management system, the system uses ASP.NET language development. There is a SQL injection vulnerability in elib, which can be exploited by attackers to obtain sensitive information from the databas...

SQL Injection Vulnerability in Qixing Company's Book Lending Management System elib

Qixing Attendance System is a system for book lending management, including front and backend management system, which is developed using ASP.NET language. There is a SQL injection vulnerability in elib, the book lending management system of Qixing Company, which can be exploited by attackers to...

SQL Injection Vulnerability in elib, the Book Lending Management System of Qixing Company (CNVD-2020-72445)

Qixing book lending system is a book lending management system, including the front and back office management system, the system uses ASP.NET language development. There is a SQL injection vulnerability in elib, which can be exploited by attackers to obtain sensitive information from the databas...

SQL Injection Vulnerability in elib, the Book Lending Management System of Qixing Company (CNVD-2020-72444)

Qixing book lending system is a book lending management system, including the front and back office management system, the system uses ASP.NET language development. There is a SQL injection vulnerability in elib, which can be exploited by attackers to obtain sensitive information from the databas...

The vulnerability of the Core component of the Oracle Banking Corporate Lending software allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Core component of the Oracle Banking Corporate Lending software lies in insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information via the HTTP network protocol...

Oracle Banking Corporate Lending Information Disclosure Vulnerability

Oracle Banking Corporate Lending is a bank loan management component of Oracle Corporation Oracle. An information disclosure vulnerability exists in the Core component of Oracle Banking Corporate Lending versions 12.3.0, 14.0.0 through 14.4.0. An attacker could exploit this vulnerability to gain...

CVE-2020-14894

Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications component: Core. Supported versions that are affected are 12.3.0 and 14.0.0-14.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...