Lender can lose funds

Lines of code Vulnerability details Impact Since some tokens take transfer fees on performing transfer operations and current contract implementation is not considering same, lender funds could be lost Proof of Concept 1. Attacker creates a loan request for token XYZ taking 10% transfer fees 2...

Function getPastDelegate may return incorrect values

Lines of code Vulnerability details Impact By calling delegate function of HolyPaladinToken contract two or more times in a single block including a transaction so it is possible to flash loan assets and pass them to more and more accounts, users can add elements to the delegateCheckpoints array...

Top 3 Attack Trends in API Security – Podcast

In late July 2021, online retailers got hit with a jaw-dropping 2,800 percent increase in attack takeovers. Dead-set on gift card fraud via “scrape for resale” and other types of fraud, the attacks spiraled up to the rate of 700,000 attacks per day. In a separate case – of a loan application frau...

Withdrawal Requests Can Be Bypassed

Lines of code Vulnerability details Impact Withdrawals can be initiated by accounts by calling the initiateWithdrawal function. A block delay is enforced with an expiration to prevent flash loan attacks on the protocol. However, because withdrawal requests are conducted on the account's token...

[WP-H4] anchor_basset_reward pending yields can be stolen

Lines of code Vulnerability details For yield farming aggregators, if the pending yield on an underlying strategy can be harvested and cause a surge of rewards to all existing investors, especially if the harvest can be triggered permissionlessly. Then the attacker can amplify the attack using a...

ERC4626 mints more shares than it should

Lines of code Vulnerability details bug in the mint function of the ERC4626 contract The mint function recieves an amount of shares and an address to and mints the amount of shares to the to address. The sender must transfer an amount of token, so that the ratio will be saved - shares / totalShar...

anti-flashloan mechanism may lead to protocol default

Handle gzeon Vulnerability details Impact There is a price check to avoid flash loan attacks which significantly moved the price. If current price is 5% lower than the stored twap price, the liquidation will fail. This design can be dangerous as it is to openleverage's benefit to close...

Flash loan price manipulation in purchasePyroFlan()

Handle sirhashalot Vulnerability details Impact The comment on line 54 of FlanBackstop.sol states "the opportunity for price manipulation through flash loans exists", and I agree that this is a serious risk. While the acceptableHighestPrice variable attempts to limit the maximum price change of t...

Cooldown and redeem windows can be rendered useless.

Handle ShippooorDAO Vulnerability details Impact Cooldown and redeem windows can be rendered useless. Proof of Concept Given an account that has not staked sNOTE. Account calls sNOTE.startCooldown Account waits for the duration of the cooldown period. Redeem period starts. Account can then deposi...

Scary Fraud Ensues When ID Theft & Usury Collide

Whats worse than finding out that identity thieves took out a 546 percent interest payday loan in your name? How about a 900 percent interest loan? Or how about not learning of the fraudulent loan until it gets handed off to collection agents? One readers nightmare experience spotlights what can...

Medium: Consider alternative price feed + ensure _minLockPeriod > 0 to prevent flash loan attacks

Handle hickuphh3 Vulnerability details Impact It is critical to ensure that minLockPeriod 0 because it is immutable and cannot be changed once set. A zero minLockPeriod will allow for flash loan attacks to occur. Vaults utilising the nonUST strategy are especially susceptible to this attack vecto...

TimeswapPair.sol#borrow() Improper implementation allows attacker to increase pool.state.z to a large value

Handle WatchPug Vulnerability details In the current implementation, borrow takes a user input value of zIncrease, while the actual collateral asset transferred in is calculated at L319, the state of pool.state.z still increased by the value of the user's input at L332. Even though a large number...

WordPress Mortgage Calculator/Loan Calculator Cross-Site Scripting Vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress Mortgage Calculator/Loan Calculator has a cross-site scripting vulnerability in versions prior to 1.5.17, which ste...

CVE-2021-24828

Vulnerability summary (CVE-2021-24828) : The WordPress plugin “Mortgage Calculator / Loan Calculator” prior to version 1.5.17 does not escape certain attributes in the mlcalc shortcode output. This can enable Cross-Site Scripting (XSS) by users with as little as a Contributor role. The issue is t...

Dishonest Stakers Can Siphon Rewards From xToken Holders Through The deposit Function In NFTXInventoryStaking

Handle leastwood Vulnerability details Impact xTokens is intended to be a representation of staked vault tokens. As the protocol's vaults accrue fees from users, these fees are intended to be distributed to users in an inconsistent fashion. NFTXInventoryStaking is one of the ways users can stake...

PriceOracle Does Not Filter Price Feed Outliers

Handle leastwood Vulnerability details Impact If for whatever reason the Chainlink oracle returns a malformed price due to oracle manipulation or a malfunctioned price, the result will be passed onto users, causing unintended consequences as a result. In the same time it's possible to construct...

Anyone can call closeLoan() to close the loan

Handle WatchPug Vulnerability details function closeLoanuint256 amount external override returns uint256 principal, uint256 interest // The amount specified is an optional amount to be transfer from the caller, as a convenience for EOAs. requireamount == uint2560 ||...

Possible price manipulation while adding liquidity to uniV3

Handle 0x421f Vulnerability details Right now if we see the code there are no checks before liq being added to check if pool is manipulated. Hence there rises possibility of sandwich attack vector here, more so with concentrated liq imo Could be done with flash loan or with own tokens Attack woul...

WordPress Mortgage Calculator / Loan Calculator plugin <= 1.5.16 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Mortgage Calculator / Loan Calculator plugin versions = 1.5.16. Solution Update the WordPress Mortgage Calculator / Loan Calculator plugin to the latest available version at least 1.5.17...

StabilizerNode Is Vulnerable To Sandwich Attacks

Handle leastwood Vulnerability details Impact The permissionless stabilize function in StabilizerNode is called to correct deviations in the Malt token price. When the price of Malt has appreciated above its peg, the function simply distributes rewards to LP token holders, effectively taking Malt...