20492 matches found
In LlamaAccount.transferERC20(), Transaction revert if the Token does not support 0 value transfer
Lines of code Vulnerability details Impact In LlamaAccount.transferERC20, Transaction revert if the Token does not support 0 value transfer when transferring tokens to recipient address. In LlamaAccount.sol, transferERC20 function is given by, File: src/accounts/LlamaAccount.sol 165 function...
Clone LlamaCore and LlamaPolicy in LlamaFactory.sol may fail or DOS
Lines of code Vulnerability details Impact LlamaFactory uses Clones.cloneDeterministic to create new LlamaCore and LlamaPolicy contracts. The address of the new PrivatePool depends solely on the name parameter keccak256abi.encodePackedname provided by the administrator when calling the deploy...
ERC721 tokens can be forever locked when transferring
Lines of code Vulnerability details Impact An action that transfers ERC721 tokens from the account contract to another contract could result in the ERC721 tokens being locked forever if the receiving contract doesn't support receiving ERC721 tokens. Proof of Concept The LlamaAccount contract uses...
Actions can stuck in Queued state
Lines of code Vulnerability details Impact According to current login - if action is in a Queued state, everyone may execute that action function executeActionActionInfo calldata actionInfo external payable is external without any modifier. When execution of action fails, it, however, is not bein...
expirationPeriod in the strategy contracts is not checked when calling LlamaCore.execute
Lines of code Vulnerability details Impact If executionPeriod is set to an extremely short time or even 0, then all actions can never be executed. Proof of Concept There are 7 states in an Action flow: Active, Canceled, Failed, Approved, Queued, Expired, Executed. Generally, the sequence goes lik...
Uses Send Value to transfer Native token instead of Transfer Function
Lines of code Vulnerability details Impact The Send Value is susceptible to a reentrancy attack. Proof of Concept If the recipient is a malicious contract that performs a reentrant call back into the LlamaAccount contract, it can execute code before the transfer is completed and potentially...
Lenovo XClarity Administrator (LXCA) Vulnerabilities - Lenovo Support US
No description provided...
dmi.ie Cross Site Scripting vulnerability OBB-3423686
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Rockwell Automation FactoryTalk Transaction Manager
1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Transaction Manager Vulnerability: Uncontrolled Resource Consumption. 2. RISK EVALUATION Successful exploitation of this vulnerability could cause the...
Rockwell Automation FactoryTalk Edge Gateway
1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low attack complexity Vendor: Rockwell Automation Equipment: FactoryTalk Edge Gateway Vulnerability: Out-of-bounds Read 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local user to cause the program to crash, causing a...
Llama Core and Policy implementation not only minimal proxy should not be allowed to be authorized as scripts
Lines of code Vulnerability details Impact authorizeScript function will be used to authorize any contract to be delegatecalled by executor's context. To be qualified as script, it should not access storage but immutable storage, because script's storage layout can be overlapped each other. I...
User can manipulate approvals and disapprovals of relative quorum strategy
Lines of code Vulnerability details Impact A malicious user with sufficient permissions can manipulate approvals and disapprovals of actions using the relative quorum strategy. They could effectively ensure that any action has an 100% chance of being approved or disapproved, even when the...
Arbitrary delegatecalls from LlamaAccount can be used to steal assets
Lines of code Vulnerability details Impact Using delegatecall to call arbitrary contracts is highly dangerous as it can be used to steal assets. An attacker could sneak in a contract that steals all the assets owned by the LlamaAccount contract. Proof of Concept Below is a diff to the existing...
Delegatecalls to contracts which have different storage layouts will cause unexpected behavor. Whitelisting of delegate-callable targets is required like LlamaCore.authorizeScript().
Lines of code Vulnerability details Impact Delegatecall to targets which have storage access will read/write each other's storage variables. Although slot 0 is protected from modification by delegatecall, reading slot 0 is not protected. Modifying storage slot other than 0 is not protected. It's...
Incorrect validation in LlamaRelativeQuorum results in improper approvals/disapprovals
Lines of code Vulnerability details Impact The LlamaRelativeQuorum contract is intended to allow for approvals/disapprovals to be configured such that, for example, an approval is triggered when a certain percentage of the total quantity for a role with this quantity being fixed at the creation o...
Signature malleability in createActionBySig allow an attacker to replicate an attack
Lines of code Vulnerability details Overview The createActionBySig is part of a family of functions that can be called by signature. This functionality is shared with castApprovalBySig and castDisapprovalBySig. However, the last two functions rely on the preCastAssertion function that revert on...
potential reentrancy attack in _mint and _burn function
Lines of code Vulnerability details Impact potential reentrancy because state changes after minting and burning, should change state first Proof of Concept Tools Used Manual Review Recommended Mitigation Steps follow check-effect-interaction pattern as following: function mintaddress policyholder...
LlamaAccount can be tricked to selfdestruct with an upgradable contract
Lines of code Vulnerability details Impact The LlamaAccount contract will be destroyed and all the assets can be lost. Proof of Concept In execute, we use readSlot0 to prevent a malicious or buggy target from taking ownership of this contract. But the malicious target can send all the assets and...
In LlamaRelativeQuorum, the governance result might be incorrect as it counts the wrong approval/disapproval.
Lines of code Vulnerability details Impact In LlamaRelativeQuorum, the governance result might be incorrect as it counts the wrong approval/disapproval. Proof of Concept The LlamaRelativeQuorum uses approval/disapproval thresholds that are specified as percentages of total supply and the...
