Mint/Burn amount during LP addition/removal changes with time

Lines of code Vulnerability details Impact When a user adds LP to the pool, they get LP tokens which they can later use to redeem their positions. The issue is that since the utility and the curve parameters change with time, so does the value of the LP tokens. Say a user wants to deposit 1 ETH t...

Missing balance checks in _reserveTokenSpecified()

Lines of code Vulnerability details Impact By calling depositGivenInputAmount and withdrawGivenOutputAmount which both call 'reserveTokenSpecified', users may potentially create scenarios where the balance ratio allowed for the EvolvedProtocol.sol deployment is violated. POC depositGivenInputAmou...

Utility per LP token can decrease in some cases.

Lines of code Vulnerability details Impact Utility per LP token can decrease in some cases. Proof of Concept The documentation in contest repo states that Within a timeslice a single block, no set of transactions swaps, deposits, withdrawals should result in a decrease of the utility per LP token...

Error of computation break the LpTokens supply, causes users to lose funds and make functions using _getUtilityFinalLp() broken.

Lines of code Vulnerability details Impact withdrawGivenOutputAmount and withdrawGivenInputAmount functions doesn't revert when balance of tokenX/tokenY = 0 and create an offset between reserve tokens and LP total supply. This lead to unwanted behaviors for the next operations on the protocol...

MAL-2023-1542 Malicious code in lp-transporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11c496a4534fa74ceededa76f0d7d5d65094550a9ba71e4ee4f25e982cc16beb The OpenSSF Package Analysis project identified 'lp-transporter' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in lp-transporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11c496a4534fa74ceededa76f0d7d5d65094550a9ba71e4ee4f25e982cc16beb The OpenSSF Package Analysis project identified 'lp-transporter' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in lp-vue-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8e0fc5aaed8de1640179a965d23507da2a63fc462c9349da8ed2eae78398c577 The OpenSSF Package Analysis project identified 'lp-vue-components' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1543 Malicious code in lp-vue-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8e0fc5aaed8de1640179a965d23507da2a63fc462c9349da8ed2eae78398c577 The OpenSSF Package Analysis project identified 'lp-vue-components' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

GeVault#poolMatchesOracle is extemely easy to manipulate due to how it calculates underlying token balances

Lines of code Vulnerability details Impact GeVaultpoolMatchesOracle uses the UniV3Pool.slot0 to determine the number of tokens it has in it's position. slot0 is the most recent data point and is therefore extremely easy to manipulate. Given that the protocol specializes in leverage, the effects o...

Usage of slot0 is extremely easy to manipulate

Lines of code Vulnerability details Impact Pool LP value can be manipulated and cause other users to receive less lp tokens. Proof of Concept TokenisableRange.sol uses slot0 to calculate several values in the code. slot0 is the most recent data point and is therefore extremely easy to manipulate...

ARBTriCryptoOracle is prone to manipulation

Lines of code Vulnerability details Impact ARBTriCryptoOracle is used to determine price of LP token of tricrypto USDT, WBTC, WETH on arbitrum. This pool is susceptible to re-entrancy due to bug in vyper 0.2.15. and hence getvirtualprice can be manipulated which is used for pricing LP tokens. Pro...

Inflation attack in well

Lines of code Vulnerability details Impact The Well.sol contract is vulnerable to a first depositor attack allowing someone to directly send funds to the pool in order to obfuscate the totalSupply and steal funds from the subsequent depositor. Proof of Concept Below is how the attack can be carri...

First liquidity provider can break minting of shares

Lines of code Vulnerability details Impact The attack vector and impact is that users may not receive shares in exchange for their deposits if the total asset amount has been manipulated through a large “donation”. Proof of Concept The attack vector and impact is that users may not receive shares...

The ethlbrStakePool, which is used in LOC 155 in EUSDMiningIncentives.sol, has no function balanceOf()

Lines of code Vulnerability details Impact The EUSDMiningIncentives.sol in LOC 155 uint256 userStaked = IEUSDethlbrStakePool.balanceOfuser; calls balanceOf function of ethlbrStakePool. By asking one of the sponsors, the address of this pool was given as 0x857CC243b8494e13BdbAde27C25ef61c2e500fda...

[M] Hardcoded address will not remain consistent across other chains

Lines of code Vulnerability details Impact The hardcoded address for the LBR token will not remain consistent across other chains, such as Polygon, Avalanche, Arbitrum and BSC for example. IEUSD0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2.balanceOfethlbrLpToken Proof of Concept Hardcoding the addre...

USN-6193-1: Linux kernel vulnerabilities

Hangyu Hua discovered that the Flower classifier implementation in the Linux kernel contained an out-of-bounds write vulnerability. An attacker could use this to cause a denial of service system crash or possibly execute arbitrary code. CVE-2023-35788, LP: 2023577 It was discovered that for some...

WordPress Theme ListingPro - WordPress Directory & Listing 安全漏洞

WordPress is a blogging platform developed in PHP by the WordPress Foundation. The platform supports personal blog sites on servers running PHP and MySQL.WordPress theme is a theme for WordPress. WordPress Theme ListingPro - A security vulnerability exists in WordPress Directory & Listing version...

lp-e.dk Cross Site Scripting vulnerability OBB-3375354

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Inconsistent check for LP balance in AMO

Lines of code Vulnerability details Inconsistent check for LP balance in AMO While pulling LP tokens from the CVXStaker contract, the AMO queries the current available balance using the staked balance, which is inconsistent with the implementation of the withdraw function. Impact Curve LP tokens...

All the lp tokens will be stuck in the AMO2 contract if CVXStaker.withdrawAllAndUnwrap is called with sendToOperator flag

Lines of code Vulnerability details Impact Loss all the stEth and xEth lp tokens. Proof of Concept The CVXStaker.withdrawAllAndUnwrap can be called by the admin. And if the sendToOperator param is true, all the lp tokens of the CVXStaker contract include lp tokens staked in the CVX and left in th...