_blockAccount doesn’t transfer asset correctly getting portion of funds locked permanently

Lines of code Vulnerability details Description When blockAccount is called and the account that is getting blocked has balance in the market, escrow contract is created and balance of the user is transferred to this contract by updating accounts mapping. When the account is unsanctioned, the...

An underflow occurred during the token transfer.

Lines of code Vulnerability details Impact An underflow can occur during a token transfer when there is insufficient allowance. Proof of Concept function transferFrom address from, address to, uint256 amount external virtual nonReentrant returns bool uint256 allowed = allowancefrommsg.sender; //...

Early market adopters can force delinquency to game borrowers

Lines of code Vulnerability details Impact When new markets are created, a lender can call WildcatMarket.updateState. This will trigger a call to WildcatMarketBase.writeState, the check on line 449 state.liquidityRequired totalAssets will return false since totalAssets starts as 0. This will...

Uninitialized State Variables

Lines of code Vulnerability details Impact in The resetTmpMarketParameters function is an internal function, which means it can only be called from within the WildcatMarketController contract itself. If a child contract inherits from WildcatMarketController and calls resetTmpMarketParameters befo...

Incorrect Order of Operations in nukeFromOrbit Function

Lines of code Vulnerability details Impact the nukeFromOrbit function, the nonReentrant modifier is correctly applied. This means that the function cannot be reentered while it is already being executed the problem is that The blockAccountstate, accountAddress function is called before...

Swapped parameters when calling createEscrow()

Lines of code Vulnerability details Impact getEscrowAddress returns the wrong WildcatSanctionsEscrow. Borrower can steal lender's escrowed funds. Proof of concept createEscrow and getEscrowAddress both take the parameters borrower, account, asset, in that order, as defined in...

potential DOS cause of rounding up at rayMul and rayDiv

Lines of code Vulnerability details Impact In rayMul and rayDiv , there is always rounding up ,cause of that , there will be potential DOS Proof of Concept function normalizeAmount MarketState memory state, uint256 amount internal pure returns uint256 return amount.rayMulstate.scaleFactor; functi...

No Create2 Contract Deployment Check can prevent a borrower from deploying contracts from a factory if deployment fails

Lines of code Vulnerability details Descripion When a contract is deployed using Create2 the deployment can fail without causing a revert. The following conditions can cause it to not revert: 1. A contract already exists at the destination address. 2. Insufficient value to transfer. 3. Sub contex...

Borrower cannot close their market

Lines of code Vulnerability details The WildcatMarket::closeMarket cannot be executed by a borrower because the WildcatMarketController contract does not implement any function calling it. Proof of Concept The closeMarket is supposed to be called by a borrower to close their market, set the...

GHSA-5WJ4-WFFQ-3378 Ingress nginx annotation injection causes arbitrary command execution

Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...

CVE-2023-42849

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Monterey 12.7.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. An attacker that has already achieved kernel code execution may be able to bypass...

CVE-2023-4966: Exploitation of Citrix NetScaler Information Disclosure Vulnerability

On October 10, 2023, Citrix published an advisory on two vulnerabilities affecting NetScaler ADC and NetScaler Gateway. The more critical of these two issues is CVE-2023-4966, a sensitive information disclosure vulnerability that allows an attacker to read large amounts of memory after the end of...

Improper access control

Instances of UniFi Network Application that i are run on a UniFi Gateway Console, and ii are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to t...

CVE-2023-5671

HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability...

Ingress nginx annotation injection causes arbitrary command execution

Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...

SafeID's ownership is not checked properly in BasicAction.generateDebt()

Lines of code Vulnerability details Impact the ownership of safe's id passed in BasicAction.generateDebt is never checked which can lead to unexpected results Proof of Concept BasicAction.generateDebt has the following code - function generateDebt address manager, address taxCollector, address...

During Safe Transfer, the Receiving User Loses Control of the Safe, Resulting in the Safe Being Lost

Lines of code Vulnerability details Impact Assuming a user wants to transfer their safe NFT to another user, post transfer Vault721::afterTokenTransfer is triggered. This function in turn calls the IODSafeManager::transferSAFEOwnership function to complete the transfer. The problem here is, that...

use of correct modifier

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps function...

M-05 Unmitigated

Lines of code Vulnerability details Mitigation of M-05: Issue NOT mitigated Mitigated issue M-05: Reward sandwiching in VotiumStrategy The issue was that exposure to the benefits of the VotiumStrategy might be unfairly time-weighted. There were two aspects mentioned: voting power and rewards. I d...

Wrong validation check for caller of some functions

Lines of code Vulnerability details Impact When an attacker call some functions which lacks validation check for msg.sender, it causes unexpected interactions. Proof of Concept The AccountingEngine.solsettleDebt function and AccountingEngine.solsettleDebtfuntion is as follows. function...