Bio Protocol - tokenURI JSON injection

Lines of code Vulnerability details Impact The Bio Protocol allows users to mint Bio NFTs that represent user's bio. Once NFT is minted anyone can trigger tokenURI to retrieve JSON data with the bio and generated svg image. Example JSON content decoded from Base64: "name": "Bio 1", "description":...

Need to check with quantity also in _beforeTokenTransfers

Lines of code Vulnerability details Impact In Tray.sol, we can see tokenId checking in beforTokenTransfers. In the current code, it assumes that quantity is 1. But we need to take care with bunch transfer. Proof of Concept function beforeTokenTransfers address, / from/ address to, uint256...

Incorrect use of the && Operator will allow anyone to fuse a new Namespace NFT

Lines of code Vulnerability details Impact Any caller can easily mint NFT if they provide a valid list of characters with the appropriate trays, the problem with this code is in this check if trayOwner != msg.sender && tray.getApprovedtrayID != msg.sender && !tray.isApprovedForAlltrayOwner,...

Unlimited minting of Canto Bio NFT

Lines of code Vulnerability details Impact There is no max limit on the number of Bio NFT that can be minted by a user. This allows an attacker to mint himself any amount of Bio NFT he want. Proof of Concept function testMint public string memory bio = "TEST BIO"; vm.prankalice; for uint i = 0; i...

Why does prelaunch checking do only for namespaceNFT case in Tray.burn?

Lines of code Vulnerability details Impact In function Tray.burnid, we can see prelaunchMinted checking. But that part is inside if msg.sender == namespaceNFT. We should take care about it in all cases. Proof of Concept function burnuint256 id external address trayOwner = ownerOfid; if namespaceN...

Lack of token approval reverts the overall trade

Lines of code Vulnerability details Impact Since the user has not approved the params.collateralAmount, calling the safeTransferFrom function will result in a revert due to the lack of token approval. The Exchange contract not receive any collateralAmount. Proof of Concept...

Hedging during liquidation is incorrect

Lines of code Vulnerability details Impact Hedging will not work as expected, and LiquidityPool will lose funds without expectation. Proof of concept 1. When a short position is liquidated in contract Exchange, function liquidate will be triggered. It will burn the power perp tokens and reduce th...

LiquidityPool.executePerpOrders(): dangerous payable function

Lines of code Vulnerability details Impact The contract LiquidityPool use a dangerous payable function executePerpOrders In this function, users can send ETH mistakenly. We should check the msg.value is 0 or not to void this issue. Proof of Concept function executePerpOrdersbytes calldata...

totalFunds update is missing in Liquidity.openShort

Lines of code Vulnerability details Impact totalFunds is not updated in Liquidity.openShort so totalFunds will be wrong. Proof of Concept Liquidity.openShort updates usedFunds only and doesn't update totalFunds. totalFunds should be updated after openShort. Tools Used Manual Review Recommended...

usedFunds is wrong after Liquidity.closeLong, openShort and closeShort

Lines of code Vulnerability details Impact usedFunds is wrong in LiquidityPool, and usedFunds tracks spent quote tokens. usedFunds is an important state in LiquidityPool, so the impact will be high. Proof of Concept Liquidity.closeLong and openShort don't update the state usedFunds correctly. In...

Namespace.sol fuse() function incorrectly calculates fused bytes

Lines of code Vulnerability details Impact The fuse function in Namespace.sol incorrectly calculates fused bytes. The first parameter to the characterToUnicodeBytes function is font class, which is always set to 0. This leads to an incorrect calculation of the tokenToName value, resulting in a...

Tray Owner Will Not be Able to Burn any Tray

Lines of code Vulnerability details Impact 1. There are two issues here, the check namespaceNFT != msg.sender && trayOwner != msg.sender && getApprovedid != msg.sender && !isApprovedForAlltrayOwner, msg.sender will only revert CallerNotAllowedToBurn if all of the conditions are true which is very...

buy() method of Tray.sol may exceed Block Limit

Lines of code Vulnerability details Impact DOS in buy method. Proof of Concept File: Tray.sol function buyuint256 amount external uint256 startingTrayId = nextTokenId; if prelaunchMinted == typeuint256.max // Still in prelaunch phase if msg.sender != owner revert OnlyOwnerCanMintPreLaunch; if...

Exchange.sol#L87 : openTrade is returning incorrect totalCost value which has accounting issue when open or closing the trade.

Lines of code Vulnerability details Impact It returns the incorrect value. Any operation done based on this function,either at front end of at contract level , could end with incorrect output. Proof of Concept User can interact with Exchangle.sol to trade. He/she will call the openTrade. openTrad...

Implementation error in Namespace.fuse() leads to a wrong unicode representation

Lines of code Vulnerability details Impact The font class of a tile will be always considered as 0 emoji when a user registers a name. Proof of Concept To register a name, fuse is used taking as input the data of the characters. The name to register is a string created by converting the character...

Adobe Connect 11.4.5 / 12.1.5 Local File Disclosure

Title: adobe connect - Local File Disclosure / Download security feature bypass vulnerability Author: h4shur date:2021.01.16-2023.02.17 CVE: CVE-2023-22232 Vendor Homepage: https://www.adobe.com Software Link: https://www.adobe.com/products/adobeconnect.html Version: 11.4.5 and earlier, 12.1.5 an...

CVE-2023-27539

A denial of service vulnerability was found in rubygem-rack in how it parses headers. A carefully crafted input can cause header parsing to take an unexpected amount of time, possibly resulting in a denial of service. Mitigation Setting Regexp.timeout in Ruby 3.2 is a possible workaround...

CVE-2023-28120

A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is called on a SafeBuffer with untrusted user input, malicious code could be executed. Mitigation Avoid calling bytesplice on a SafeBuffer htmlsafe string with untrusted user input...

Namespace tokenName has only emojis.

Lines of code Vulnerability details Impact The tokenName and image of Namespace should always be the same. The image is correct but the tokenName only consists of emojis. Duplicate names are checked on the tokenName and not on the image. Because of this a tile of font class 1 with character index...

Underflow if enough amount is sent to the contract

Lines of code Vulnerability details Impact In function withdraw function withdrawaddress l1Receiver external payable override uint256 amount = msg.value; // Silent burning of the ether unchecked balanceaddressthis -= amount; totalSupply -= amount; they are using unchecked to decrease balances. Th...