Loans can be rolled an unlimited number of times

Lines of code Vulnerability details Impact Loans can be rolled an unlimited number of times, without letting the lender decide if has been done too many times already Proof of Concept It will cause the totalBorrow of the contract to increase infinitely, affecting the exchangeRate. Tools Used manu...

Extraordinary Funding proposal could be susceptible back-run

Lines of code Vulnerability details Impact An extraordinary proposal can be proposed, voted on, and executed within a single transaction, in the same block. As a result, an attacker with enough voting power to meet the conditions on their own could back-run a transaction to steal funds from the...

Insufficient Timestamp Validation for Signed Messages

Lines of code Vulnerability details Impact A message can be signed by the oracle for any future point in time, and it will be valid for 20 minutes. If messages with invalid timestamps pointing to the future get signed, there is no way of invalidating them. A compromised or malfunctioning oracle...

PoolApeStaking#withdrawApeCoin compares health factor to incorrect value and allows user to take out large loans that expected

Lines of code Vulnerability details Impact BAYC, MAYC and BAKC can be leveraged past max LTV and up to the liquidation factor Proof of Concept function withdrawApeCoin address nftAsset, ApeCoinStaking.SingleNft calldata nfts external nonReentrant DataTypes.PoolStorage storage ps = poolStorage;...

Vulnerabilities fixed in Oracle Financial Services Applications

Vulnerabilities have been fixed in Oracle Financial Services Applications. The vulnerabilities allow a malicious party to perform attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Circumvention of security measure Remote code execution User righ...

HARDCODED PRICES FOR STABLECOINS

Lines of code Vulnerability details Impact Hardcoded prices of stablecosins may open some arbitrage opportunities and produce many bad loans in CLM. Proof of Concept Hardcoding price of cUSDT and cUSDC as 1 may open some arbitrage opportunities when real price for each token is a little bit...

The vulnerability of the “Loans And Deposits” sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system’s simulation model allows a perpetrator to gain access to and modify data.

The vulnerability of the “Loans And Deposits” sub-component of the Oracle FLEXCUBE Universal Banking banking analytics system’s simulation model exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to read,...

Vulnerabilities fixed in Oracle Financial Services Applications

Oracle has fixed vulnerabilities in the following Financial Services applications: - Oracle Banking Deposits and Lines of Credit Servicing - Oracle Banking Enterprise Default Management - Oracle Banking Loans Servicing - Oracle Banking Party Management - Oracle Banking Payments - Oracle Banking...

UniV3LpVault flash loans can become unavailable if a user didn't utilized the full limit

Lines of code Vulnerability details Impact If a user didn't utilized the whole amount on the first call, the flashFocusCall can fail for second and subsequent runs when params.asset is a token that use approval race protection. Placing severity to medium as flashFocusCall reverts in this case, an...

money-market-contracts::overseer: Market ltv is not capped

Lines of code Vulnerability details Impact There is no check to ensure that maxltv is less than 100% Decimal::One. It is therefore possible to set a collateral factor of 1, allowing anyone to borrow more than the collateral value ie. enabling under-collateralized loans. While the likelihood of...

Extra fees paid for flash loans are unassigned

Handle 0x0x0x Vulnerability details Extra fees paid for flash loan are not included in total collected fees and they create excess balance which can be claimable by streamCreator. Extra fees should also get assigned to factory or atleast it should be clear that extra fees are for streamCreator...

Miscalculation of _supplyCreditUni allows undercollateralized loan

Handle WatchPug Vulnerability details In supplyCreditUni, the calculation of the collateral value of tokenB supply is using priceB instead of priceA, which can lead to undercollateralized loans. function supplyCreditUni address account, address returnToken, uint priceA, uint priceB, uint...

CVE-2021-2324

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications component: Loans And Deposits. Supported versions that are affected are 12.0-12.4, 14.0-14.4 and . Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

Design/Logic Flaw

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications component: Loans And Deposits. Supported versions that are affected are 12.0-12.4, 14.0-14.4 and . Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

Oracle FLEXCUBE Universal Banking has an unspecified vulnerability (CNVD-2021-54691)

An unspecified vulnerability exists in the Loans And Deposits component of Oracle FLEXCUBE Universal Banking, a real-time, online, comprehensive global core banking solution that covers retail, corporate, and investment banking. An attacker could exploit this vulnerability to compromise...

[Pool] - Anyone can remove liquidity from Pools, allowing them to alter the price

Handle adelamo Vulnerability details Impact On the Pool.sol, the function removeForMember is public. Allowing anyone to call the method using an address of an LP in order to remove liquidity from the pools and return to the LP account. If we combine the ability to remove liquidity and being able ...

CVE-2021-2324

Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications component: Loans And Deposits. Supported versions that are affected are 12.0-12.4, 14.0-14.4 and . Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ...

CVE-2021-2324

The CVE-2021-2324 entry concerns Oracle FLEXCUBE Universal Banking (Loans and Deposits). Affected supported versions are 12.0–12.4 and 14.0–14.4. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise data, with exploitation requiring user interaction. Impac...

Oracle FLEXCUBE Direct Banking安全漏洞

An unspecified vulnerability exists in the Loans And Deposits component of Oracle FLEXCUBE Universal Banking, a real-time, online, comprehensive global core banking solution that covers retail, corporate, and investment banking. An attacker could exploit this vulnerability to compromise...

avoid paying insurance

Handle gpersoon Vulnerability details Impact It's possible to avoid paying insurance in the following way: once per hour at the right moment, do the following: ----using a flash loan, or with a large amount of tokens, call deposit of Insurance.sol to make sure that the pool is sufficiently filled...