ltv-online.info Cross Site Scripting vulnerability OBB-3894997

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PoolApeStaking#withdrawApeCoin compares health factor to incorrect value and allows user to take out large loans that expected

Lines of code Vulnerability details Impact BAYC, MAYC and BAKC can be leveraged past max LTV and up to the liquidation factor Proof of Concept function withdrawApeCoin address nftAsset, ApeCoinStaking.SingleNft calldata nfts external nonReentrant DataTypes.PoolStorage storage ps = poolStorage;...

Lack of minimal sufficient liquidity check can result in unreliable prices

Lines of code Vulnerability details function getPriceCantoaddress token internal view returnsuint erc20 token = erc20token; address pair = pairForaddresswcanto, addresstoken, false; if !isPairpair return 0; // this pair does not exist with Canto uint decimals = 10 token.decimals; // get decimals ...

there is no calculation or checks for LTV

Lines of code Vulnerability details Impact The users decide how much Collateral to send and how many assets to borrow Proof of Concept In the Functions: Borrowing part exactly with borrowAsset and addCollateral there is no calculation or checks for LTV so the users just pass any amount and it wil...

ltv-sachsen.de Cross Site Scripting vulnerability OBB-2776012

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Lower LVT is treated as less restrictive, while it's vice versa

Lines of code Vulnerability details Impact Lender can accept overly restrictive LTV the lowest possible at the moment, with high enough probability being able to seize the collateral after a short time. Lender can set ltvBPS to zero with and immediately liquidate with removeCollateral any loan no...

ltv-sachsen.de Cross Site Scripting vulnerability OBB-2146349

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

ltv-shop.ru Cross Site Scripting vulnerability

Security Researcher howardpotts Helped patch 158 vulnerabilities Received 3 Coordinated Disclosure badges , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting ltv-shop.ru website and its users. Following coordinated and responsible...