INCORRECT ACCESS CONTROL

Lines of code Vulnerability details Impact Access control plays an important role in segregation of privileges in smart contracts and other applications. If this is misconfigured or not properly validated on sensitive functions, it may lead to loss of funds, tokens and in some cases compromise of...

Usage of slot0 is extremely easy to manipulate

Lines of code Vulnerability details Impact Pool LP value can be manipulated and cause other users to receive less lp tokens. Proof of Concept TokenisableRange.sol uses slot0 to calculate several values in the code. slot0 is the most recent data point and is therefore extremely easy to manipulate...

Unchecked Call Return Value

Lines of code Vulnerability details Impact The functions do not check the return value of low-level calls. This can lock Ether in the contract if the call fails or may compromise the contract if the ownership is being changed. The following calls were detected without return value validations -...

Mitsubishi Electric MELSEC-F Series Authentication Bypass By Capture-Replay (CVE-2023-2846)

Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially crafted packets. This plugin only works wit...

Protocol won't work with tokens that can prevent transfers

Lines of code Vulnerability details Impact There are various tokens and token standards that can result in transfers being stopped, blocked, blacklisted, paused or disallowed. This entails protocols may function well with these tokens up until a time when any of above measures activated leading t...

cleanup() does not properly handle debt repayment

Lines of code Vulnerability details Impact The cleanup... function in the PositionManager.sol contract is used to deposit remaining users assets back to ROE, repaying debt if any. However the users debt will not be repaid if the user has debt leading to loss of funds for the lenders and the proje...

The system is subjected to Cross-Contract Reentrancy due to Insufficient validation for tokens, source and liquidity Pairs

Lines of code Vulnerability details Impact A malicious actor can gain control of the liquidation process which can manipulate the POOL token price Proof of Concept Almost all the pieces of the protocol are open to everyone with no guard, and that can cause a serious problem. consider the followin...

getTickAtSqrtRatio used in TokenisableRange.sol to calculate lower and upper ticks is used without letting for overflow behavior, which is required

Lines of code Vulnerability details Impact The function getTickAtSqrtRatio is used multiple times in the TokenisableRange.sol, but the library TickMath.sol is compiled with pragma solidity ^0.8.4 as you can see here which doesn't allow for overflows, and since the function is not unchecked,...

It is possible that function rngComplete() does not iterate through all rewards

Lines of code Vulnerability details Impact In RngRelayAuction.sol we have rngComplete: function rngComplete uint256 randomNumber, uint256 rngCompletedAt, address rewardRecipient, uint32 sequenceId, AuctionResult calldata rngAuctionResult external returns bytes32 if...

Unauthorized Access to Critical Functions in Smart Contract

Lines of code Vulnerability details Description The provided smart contract contains critical functions, such as close, closeDebt, and withdrawOptionAssets, that can be called by any external address without proper authentication or authorization checks. This lack of access control exposes the...

integer underflow vulnerability in the _fractionalReward() function

Lines of code Vulnerability details Impact It could cause an integer underflow when calculating the reward fraction, resulting in the attacker getting more rewards than intended. True or false, explain in details, show relevant code and explain proof of co Proof of Concept The...

Incorrect Target Amount Calculation with Different Decimals in OptionPositionManager Contract

Lines of code Vulnerability details Bug Description In the OptionPositionManager contract, at line 524, there is a calculation error in the implementation of the getTargetAmountFromOracle function. This function calculates the target amount amountB based on the prices of assets A and B obtained...

The treasury address can be updated by the contract owner to point to a malicious address after deployment

Lines of code Vulnerability details Impact Any fees or funds sent to the treasury could potentially be stolen or manipulated Proof of Concept The treasury address can be updated by the contract owner to point to a malicious address after deployment. This presents a risk as the treasury receives a...

PT-2023-4516 · Tp Link · Tp-Link Tl-Wr941Nd +2

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR940N version V2 TP-Link TL-WR941ND version V5 TP-Link TL-WR841N version V8 Description: The issue is related to a buffer overflow in the /userRpm/AccessCtrlAccessRulesRpm component of TP-Link routers. This allows attackers to cau...

RngRelayAuction.rngComplete() DOS attack

Lines of code Vulnerability details Impact If the recipient maliciously enters the blacklist of priceToken, it may cause rngComplete to fail to execute successfully Proof of Concept The current implementation of RngRelayAuction.rngComplete immediately transfers the prizeToken to the recipient...

initiator in OptionsPositionManager.executeOperation is not checked

Lines of code Vulnerability details Impact An attacker can execute flashloan pretending to be other user. Proof of Concept LendigPool.flashloan sends which user called in the parameter initiator, but it is not used in executeOperation. Tools Used Manual review. Recommended Mitigation Steps Check ...

swapExactTokensForTokens and swapTokensForExactTokens in OptionsPositionManager.sol uses UniswapV2Router01 which doesn't exist on Arbitrum

Lines of code Vulnerability details Impact The functions swapExactTokensForTokens and swapTokensForExactTokens are using UniswapV2Router01 to make swaps in different functions like closeDebt, withdrawOptionAssets or swapTokens, but that would not be possible and those function would revert. Proof...

Missing flash loan initiator check allows attacker to open trades, close trades and steal funds

Lines of code Vulnerability details Impact The attacker can close trades, partially close trades and even steal funds. Proof of Concept The OptionsPositionManager.executeOperation function is called when a flash loan is made and it can only be called by the lendingPool. The wrong assumption by th...

UNCHECKED TRANSFER

Lines of code Vulnerability details Impact Some tokens do not revert the transaction when transferFrom fails and returns False. Hence we must check the return value after calling the transfer or transferFrom function. Proof of Concept Check the last answer here: In short: Using...

Calculations like valueX8 and liquidity do not account for potential rounding errors

Lines of code Vulnerability details Impact These small inaccuracies could accumulate and cause the total supply of liquidity tokens to not exactly match the vault holdings. This could allow an attacker to potentially deposit tokens, get liquidity that is slightly higher than what they should base...