Security update for dcmtk (moderate)

openSUSE Security Update: Security update for dcmtk Announcement ID: openSUSE-SU-2023:0108-1 Rating: moderate References: 1206070 1208637 1208638 1208639 Cross-References: CVE-2022-2119 CVE-2022-2120 CVE-2022-2121 CVE-2022-43272 CVSS scores: CVE-2022-2119 NVD : 9.8...

Shortfall.sol#placeBid does not limit the bid spread

Lines of code Vulnerability details Impact Shortfall.solplaceBid does not limit the bid spread. The attacker can increase the price by a small amount each time causing the auction to never stop. Proof of Concept Tools Used manual Recommended Mitigation Steps limit the bid spread Assessed type DoS...

the blocksPerYear for the WhitePaperInterestRateModel is set incorrectly

Lines of code Vulnerability details Impact the blocksPerYear is set to 2102400 in the WhitePaperInterestRateModel this should be equal to number of blocks per year that is assumed by the interest rate model, but the number of block is set incorrectly and it's not equal to block per year. Proof of...

Using old oracle prices for estimation users assets before redeeming

Lines of code Vulnerability details Impact Users can avoid correct estimation of assets and redeem more tokens than would redeem in case of estimation with updated oracle prices. Proof of Concept exitMarket function doesn't call oracle.updatePrice before checkRedeemAllowed check at all...

Virgin stake can claim all drops

Lines of code Vulnerability details Impact If wxETH drips when nothing is staked, then the first staker can claim every drop. Proof of Concept Suppose drip is enabled when totalSupply == 0. At least one block passes and the first staker stakes, just 1 xETH is enough. This mints her 1 wxETH. This...

CVE-2023-32784

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file pagefile.sys, hibernation file hiberfil.sys, or RAM dump of the entire system. The...

When borrowRateMantissa is higher than the limit value, VToken contract will be DOS

Lines of code Vulnerability details Impact File: VToken.sol 678 function accrueInterest public virtual override returns uint256 --skip-- 695 uint256 borrowRateMantissa = interestRateModel.getBorrowRatecashPrior, borrowsPrior, reservesPrior; 696 requireborrowRateMantissa borrowRateMaxMantissa. Thi...

VToken mint -- Inflation attack

Lines of code Vulnerability details Impact The token could be impacted by an inflation attack. Proof of Concept At present, vToken is still susceptible to the well-known ERC4626 'Inflation Attack'. This vulnerability allows the total asset count to be inflated by making donations. This means that...

Precision differences when calculating the _startAuction of funds accumulated in RiskFund

Lines of code Vulnerability details Impact When calculating startAuction uint256 usdValue in RiskFund, Auction state divides the value of each market in the vToken list in token list precision. This skew is fine for most tokens but will cause problems with certain token pairs. Proof of Concept Wh...

Shortfall.sol#initialize's waitForFirstBidder and nextBidderBlockLimit too short

Lines of code Vulnerability details Impact File: Shortfall.sol 147 waitForFirstBidder = 100; 148 nextBidderBlockLimit = 10; Binance Smart Chain has a block time of around 3 seconds. This could lead to an attacker blocking other bids to bid for the token at a low price. Proof of Concept Tools Used...

Every time borrow, the interest is treated as a loan to calculate the interest

Lines of code Vulnerability details Impact File: VToken.sol 896 uint256 accountBorrowsPrev = borrowBalanceStoredborrower; 897 uint256 accountBorrowsNew = accountBorrowsPrev + borrowAmount; After each loan, the original interest will be converted into the loan amount. This can cause interest to...

Borrower can redeem there collateral without repaying debt completely

Lines of code Vulnerability details Impact A borrower can redeem token in a pool though it has been used as a collateral in another pool without repaying the debt. Borrower can redeem the token as underlying asset even if his/her loan position is in the situation of liquidation. Proof of Concept...

Loans can be rolled an unlimited number of times

Lines of code Vulnerability details Impact Loans can be rolled an unlimited number of times, without letting the lender decide if has been done too many times already Proof of Concept It will cause the totalBorrow of the contract to increase infinitely, affecting the exchangeRate. Tools Used manu...

Comptroller.sol#liquidateCalculateSeizeTokens assumes the same precision for vTokenBorrowed and vTokenCollateral

Lines of code Vulnerability details Impact File: Comptroller.sol 1099 uint256 exchangeRateMantissa = VTokenvTokenCollateral.exchangeRateStored; // Note: reverts on error 1100 uint256 seizeTokens; 1101 Exp memory numerator; 1102 Exp memory denominator; 1103 Exp memory ratio; 1104 1105 numerator =...

Incorrect decimal handling in _startAuction, resulting in wrong auction.startBidBps

Lines of code Vulnerability details Shortfall.startAuction uses the oracle price of the underlying tokens to price the pool bad debt: Shortfall.sol 389: for uint256 i; i the price returned by priceOracle.getUnderlyingPrice has a number of decimals equal to 36 - vToken decimals. This means the...

getAccountSnapShot always returns NO_ERROR no matter what's its inputs is.

Lines of code Vulnerability details Impact In the safeGetAccountSnapShot function, it seems the getAccountSnapshot always return NOERROR, so the checking if err != 0 revert SnapshotErroraddressvToken, user; Becomes meaningless because err is always equal to 0. This may lead to critical issues...

withdrawAllAndUnwrap() the clpToken transfer to AMO.sol may be locked in the contract

Lines of code Vulnerability details Impact in withdrawAllAndUnwrap the clpToken transfer to AMO.sol may be locked in the contract Proof of Concept withdrawAllAndUnwrap You can specify sendToOperator==true to transfer the clpToken to operator The code is as follows: function withdrawAllAndUnwrap...

Wrong WhitePaperInterestRateModel block per year calculations incur losses for users and the protocol

Lines of code Vulnerability details Vulnerability Details Blocks per year calculations in WhitePaperInterestRateModel improperly assume 15 seconds block time, while on Binance Smart Chain it’s 3 seconds. This has grave consequences, because it is used in calculating borrower’s interest rate and...

CVE-2023-32784

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file pagefile.sys, hibernation file hiberfil.sys, or RAM dump of the entire system. The...

Comptroller.sol#healAccount did not call updateRewardTokenBorrowIndex to update the reward

Lines of code Vulnerability details Impact healAccount should call updateRewardTokenBorrowIndex to calculate the reward before affecting the debt value. Proof of Concept Tools Used manual Recommended Mitigation Steps call updateRewardTokenBorrowIndex before heal account. Assessed type Other --- T...