Missing Ownership Check in mint Function

Lines of code Vulnerability details Description: The mint function in the PrincipalToken contract lacks a crucial ownership check before allowing token minting. While it correctly checks if the caller is the delegateToken contract to restrict minting to authorized contracts, it doesn't verify if...

Stealing extra mint fund by applying reentrancy attack on _execute with calling approve() again due to external call before crucial state update

Lines of code Vulnerability details Impact By applying reentrancy attack involving the function mintIfThresholdMet, an user can steal extra amount of mint fund. Proof of Concept The functions mintIfThresholdMet make external mint call prior to updating the txnHashToTransaction state. If the real...

PT-2023-8023

Name of the Vulnerable Software and Affected Versions Linux Mint Xreader affected versions not specified Description This issue allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this issue, where the target...

PT-2023-26348 · Linux Mint +2 · Linuxmint +2

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The issue is not considered a security issue. Recommendations: At the moment, there is no information about a newer version that contains a fix for this issue...

Time Manipulation attack on reliance on block.timestamp for time-sensitive operations.

Lines of code Vulnerability details Impact The block.timestamp allows a miner to call the mint function before the intended starting time mintingAllowedAfter which could lead to time manipulation. Contract name: ArcadeToken.sol Code link: Code line: function mintaddress to, uint256 amount externa...

StandardizedToken can be setup multiple times by anyone. Causing unlimited mint by anyone.

Lines of code Vulnerability details Impact StandardizedToken can be setup multiple times by anyone. Causing unlimited mint by anyone. Proof of Concept function setupbytes calldata params external override onlyProxy address distributor; address tokenManager; string memory tokenName; tokenManager,...

Addresses in modifier not set correctly

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Addresses that are mintlimiter but not governance will revert thus being able not to call some functions as intended. Proof of Concept In the comment it was stated that it is either mint limiter or...

balanceOf method can be manipulate to liquidated vault

Lines of code Vulnerability details Impact Deriving price from balanceOf can be manipulated to liquidate vault see example Attacker can provide ERC20 token to the vaultAsset and mint vault shares. The deposited tokens will then be withdrawn with having same shares in the vault. The shares then wi...

Anyone can mint to themselves type(uint96).max if _isVaultCollateralized() returns true

Lines of code Vulnerability details Impact There is no check that ensures the caller to mint is a trusted one. Moreover, there is a flaw which lets anyone to mint typeuint96.max number of shares Proof of Concept First, the mint function does not implement any check for the caller to be someone wi...

Decimal is not correct in fee calculation

Lines of code Vulnerability details Impact The decimal doesn't match in the fee calculation, so this will break the fee calculation. Since fee calculation is very important in Mint/Burn actions, this problem can ruin the core functionality of transmuter. Proof of Concept This is the non-exact min...

Slippage controls for calling bHermes contract's ERC4626DepositOnly.deposit and ERC4626DepositOnly.mint functions are missing

Lines of code Vulnerability details Impact mentions that "if implementors intend to support EOA account access directly, they should consider adding an additional function call for deposit/mint/withdraw/redeem with the means to accommodate slippage loss or unexpected deposit/withdrawal limits,...

the mint function in erc4626 will mint incorrect amount

Lines of code Vulnerability details Impact if you look at the ERC4626 contract the function mint minting the wrong amount at line 53 it should be minting the assets amount not the amount of the share and because the shares and assets are not 1:1 it will lead to unwanted results and different mint...

contract has the tendency to mint more tokens than it actually has

Lines of code Vulnerability details Impact If the contract does not have enough esLBR tokens to mint and transfer as rewards, users will not be able to claim their rewards even if they have earned them. Proof of Concept There is no check to ensure that the contract's balance of esLBR tokens is...

M-10 Unmitigated

Lines of code Vulnerability details Mitigation of M-10: Issue NOT mitigated Mitigated issue M-10: First 1 wei deposit can produce lose of user xETH funds in wxETH Fix: code-423n4/2023-05-xeth@fbb2972 The issue is similar to the standard inflation attack, except that instead of the attacker's...

M-05 Unmitigated

Lines of code Vulnerability details The mitigation makes accrueDrip is disable until the totalSupply 0. But the lastReport blocknumber is not updated. So all the dripped rewards still are collected by the first staker when the drip modifier is called at the second time. Impact If wxETH drips when...

linuxmintusers.de Cross Site Scripting vulnerability OBB-3427279

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Failure to check reservedRate can lead to a decrease in assets

Lines of code Vulnerability details Impact The payParams function takes the data parameter, which contains the reservedRate. If reservedRate exceeds MAXRESERVEDRATE, then this causes nonReservedToken to be incremented. This results in a decrease in assets and a larger mint. Proof of Concept...

unstake() function: The unstake function permits the unstaking of multiple position NFTs from the same liquidity pool (LP) by the same lender. This opens the possibility for a lender to claim more Ajna token rewards than they are entitled to by staking and unstaking multiple NFTs associated with the same LP.

Lines of code Vulnerability details Impact The absence of a mechanism to prevent a lender from unstaking multiple NFTs for the same liquidity pool LP could potentially lead to the exploitation of the Ajna token reward system. A lender can mint, stake, and unstake multiple NFTs for the same LP fro...

Microsoft Warns of State-Sponsored Attacks Exploiting Critical PaperCut Vulnerability

Iranian nation-state groups have now joined financially motivated actors in actively exploiting a critical flaw in PaperCut print management software, Microsoft disclosed over the weekend. The tech giant's threat intelligence team said it observed both Mango Sandstorm Mercury and Mint Sandstorm...

Mitigation of M-08: Issue not mitigated

MITIGATION IS NOT CONFIRMED MITIGATION IS NOT CONFIRMED Mitigation of M-08: Issue not mitigated Link to Issue: code-423n4/2023-03-asymmetry-findings685 Comments First, there is a clear error in the associated description of mitigation: "Use Chainlink to get rETH". Using Chainlink to obtain the...