Malicious code in minter-typescript (npm)

The package minter-typescript was found to contain malicious code...

MAL-2025-48741 Malicious code in minter-typescript (npm)

The package minter-typescript was found to contain malicious code...

Malicious code in frame-minter-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edbfd183462b159a20b8cfbbf493357ec40a76dc283c070eb9a9dfb8e4f172fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nft-minter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3efd99532af6292091ff8943b7e0583961ca2a4fe82f73968118d5d189bfd39c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1616 Malicious code in nft-minter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3efd99532af6292091ff8943b7e0583961ca2a4fe82f73968118d5d189bfd39c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Leap year not accounted for OLAS and veOLAS contract

Lines of code Vulnerability details Impact OLAS and veOLAS contract does not account for years with 366 days in it's state variables uint256 public constant oneYear = 1 days 365; and uint256 internal constant MAXTIME = 4 365 86400; The problem with this is that, in OLAS.sol, minter can exceed...

Multiple re-entrancy issues allowing stealing of funds and bypassing protocol mint limits

Lines of code Vulnerability details Impact Multiple re-entrancy issues exist in the codebase, that break core functionality and allow stealing of user funds. In AuctionDemo.sol contract re-entrancy in cancelBid and cancelAllBids allows stealing of user funds. There are multiple attack surfaces,...

EthenaMinting.sol#_setMaxRedeemPerBlock() - Function doesn't enforce any constraints

Lines of code Vulnerability details Explanation The EthenaMinting.solsetMaxMintPerBlock function is responsible for setting the maximum limit for minting USDe tokens in a single block. function setMaxMintPerBlockuint256 maxMintPerBlock external onlyRoleDEFAULTADMINROLE...

Compromised minter can change route to misdirect user funds

Lines of code Vulnerability details Impact The current security assumption revolves around the compromise of a minter, wherein they mint 200k USDe tokens for themselves and subsequently redeem them within the contract. Under this assumption, as long as the gatekeeper key remains secure, the minte...

Let Me Suggest For You

Lines of code Vulnerability details Impact Scope of vulnerabiliy - This vulnerability allows any user including users the do not own any share tokens to effectivly cast a veto on a minter suggetion. The only requirement to excecute the vulnerability is to have the minimun fee in the acccount. In...

Lack of removal of minters reduces chances of survival

Lines of code Vulnerability details Impact It is reasonable to assume there will be occasions of misbehaving minters that will threaten the functioning of the Frankencoin ecosystem and there is no way to disable any such minter without redeploying the contract. Ex. an attacker can deploy a...

The minter can steal the Frankencoin in notifyLoss()

Lines of code Vulnerability details Impact The minter can steal the Frankencoin in notifyLoss because of In this code: if reserveLeft = amount transferaddressreserve, msg.sender, amount; The minter can call the function notifyLoss Constantly. When reserveLeft = amount, the minter who call the fir...

Attacker can extract unlimited ZCHF by setting a high price for a position and challenging it

Lines of code Vulnerability details An attacker can act as both minter and challenger, and profit by setting an arbitrarily high price for a position way higher than what the collateral really is worth, and then immediately challenging the position. After the challenge succeeds, the attacker will...

Upgraded Q -> M from #3 [1673008410396]

Judge has assessed an item in Issue 3 as M risk. The relevant finding follows: MAXSUPPLY of RuniverseLand could be reached before RuniverseLandMinter mints all tokens because of secondary minter RuniverseLand has a MAXSUPPLY of 70000, which is also the sum of all plotsAvailablePerSize within...

[NAZ-H1] Reentrancy From Use of _safeMint()

Lines of code Vulnerability details Impact The mint function is used to mint a new position NFT and is only callable by minter. This function uses safeMint to mint these position NFTs which has been known in the past to have Reentrancy issues. Proof of Concept The dangers of surprising code by...

removeMinter function DoS

Lines of code Vulnerability details Description There is a removeMinter function in ERC20PermitPermissionedMint. The function performs the removal minteraddress from the special address list. In other words, the function is needed to remove special access for a specific address. // Remove a minte...

FEI Minter can drain SimpleFeiDaiPSM contract DAI balance

Lines of code Vulnerability details Impact The FEI token contract contain a mint function which allow the MINTER to mint a given amount of FEI tokens to any account including his own address. So the Minter can mint to his own account an amount of FEI tokens equivalent to the SimpleFeiDaiPSM...

Governance Token limit can be massively increased due to uninitialised lastEvent variable

Lines of code Vulnerability details Impact Due to insufficient checks in the executeInflationRateUpdate in the Minter contract, the limit on tokens that can be minted is massively increased. As lastEvent is uninitialised and equal to 0 by default, in the first line of executeInflationRateUpdate,...

deposit function of VeAssetDepositor.sol will be failed if stakeAddress is set.

Lines of code Vulnerability details Impact Wrong contract variable is used, so transaction cannot be executed. Proof of Concept This line is trying to call ERC20 function from minter contract. The minter is not ERC20 token, and does not have safeApprove function. So this will revert transaction...

funds related to one cycle will be locked and lost if update_period() of Minter contract has not been called in a cycle

Lines of code Vulnerability details Impact updateperiod calculates emissions of current cycle and transfer them. but if in one cycle this function is not called then for that cycle emissions wouldn't get calculated and distributed because updateperiod can only do this logic for current cycle not...