H-01 Unmitigated

Lines of code Vulnerability details Mitigation of H-01: Issue NOT mitigated Mitigated issue H-01: Intrinsic arbitrage from price discrepancy The issue was that a price discrepancy between the exchange and oracle could be exploited within AfEth for an arbitrage. Mitigation review The maximum profi...

[M-08] Mitigation error: withdrawStuckTokens() breaks trackedCvxBalance

Lines of code Vulnerability details Impact withdrawStuckTokens may incorrectly reduce trackedCvxBalance, which breaks the balance accounting. Proof of Concept function withdrawStuckTokensaddress token public onlyOwner uint256 tokenBalance = IERC20token.balanceOfaddressthis; if token == CVXADDRESS...

All functions in ODSafeManager.sol related to handlerAllowed modifier can never be called.

Lines of code Vulnerability details Impact All the functions with handlerAllowed modifier are unusable and can never be called. Proof of Concept Handler is deployed and assigned to the Safe/NFT when ODSafeManager.sol/openSAFE function is called. The SafeHandler.sol have only a constructor and not...

Manipulation of NFV can trick it's buyer to have it on unexpected condition.

Lines of code Vulnerability details Impact NFV can be sold at a price not expected by the user or may be susceptible to liquidation shortly after buying it. Proof of Concept openSAFE function in ODSafeManager is supposed to be called by the ODProxy and mints nft for it, furthermore it calls...

TWAP can lead to loss of manipulation of price

Lines of code Vulnerability details Impact There are tradeoffs when choosing the length of the period of time to calculate a TWAP. Longer periods are better to protect against price manipulation, but come at the expense of a slower, and potentially less accurate, price. Proof of Concept Both the...

Lack of Reentrancy guard on auctionSurplus() function

Lines of code Vulnerability details Impact auctionSurplus function have call backs that can lead to reentrancy and manipulating the transfer of tokens. Malicious actor can manipulate token transfer by changing the destination address to himself and get all the extra tokens. Proof of Concept...

M-05 Unmitigated

Lines of code Vulnerability details Mitigation of M-05: Mitigation Error, see comments Link to Issue: code-423n4/2023-09-asymmetry-findings45 Comments To mitigate M-05, the sponsor has added a delay of one epoch when the available CVX balance is enough to cover the withdrawal: 81: uint256...

Broken logical expression in onlyManager()

Lines of code Vulnerability details Original Issue H-05: Functions in the VotiumStrategy contract are susceptible to sandwich attacks Details Depositing/withdrawing directly to/from derivatives provides an opportunity for an adversary to sandwich the users, since the slippage control mechanism wa...

ODProxy is flawed due to delegatecall to ODSafeManager which render system inoperable

Lines of code Vulnerability details Impact The vulnerability arises from the use of delegatecall to interact with the ODSafeManager contract, which is designed to store the context of the safe manager. However, the data inside ODSafeManager is never properly updated when ODProxy uses delegatecall...

Rounding Bug in OracleLibrary.consult Impacting Pricing Accuracy and User Costs

Lines of code Vulnerability details Impact The rounding bug in the OracleLibrary.consult function has a significant impact on applications that rely on this function for price calculations, especially those involving asset swaps, collateral valuation, or other financial transactions. The bug caus...

CamelotRelayer uses wrong interface for CamelotPair

Lines of code Vulnerability details Impact The CamelotRelayer uses the OracleLibrary as an interface for accessing oracle data from the CamelotPair contract which is the Camelot DEX's equivalent of a pool using the OracleLibrary from UniSwapV3Pool's periphery contracts but because the CamelotPair...

Front-running the Vault721.sol::build(address _user) can DoS the protocol for new users

Lines of code Vulnerability details Impact New users can't register and use the protocol until they discover the deployed address of their proxy, which is detrimental to the protocol's reputation Proof of Concept Attackers/bots are able to DOS the protocol for the new users who wants to create...

surplusTransferPercentage will always be less than 1%

Lines of code Vulnerability details Impact The protocol has a feature to auction the surplus amount and send some % out of that to extraSurplusReceiver but currently this % always less than 1% which limits the amount extraSurplusReceiver can get out of the surplus Proof of Concept we believe this...

M-06 Unmitigated

Lines of code Vulnerability details Mitigation of M-06: Issue NOT mitigated Mitigated issue M-06: Missing deadline check for AfEth actions The issue was missing deadline checks for deposits and withdrawals. Mitigation review - missing deadline for rewards Deadline parameters have been added to...

Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF

Summary The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. It is possibl...

WordPress Mediabay Plugin <= 1.6 is vulnerable to Broken Access Control

Software Mediabay Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46612 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 01f288807115 Credits emad Required privilege Subscriber...

PT-2023-29675 · Unknown · Peter'S Custom Anti-Spam

Name of the Vulnerable Software and Affected Versions: Peter Keung Peter’s Custom Anti-Spam plugin versions = 3.2.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. No information is provided about the estimated number of potentially affected devic...

PT-2023-29571 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzzCMS version 2.1.9 Description: The issue allows a remote attacker to execute arbitrary code via modification of the imageext parameter from jpg, jpeg, gif, and png to jpg, jpeg, gif, png, pphphp. This enables the attacker to potentially...

CVE-2023-5633

The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user...

Updated kernel packages fix security vulnerabilities

This kernel update is based on upstream 6.4.16 and fixes or adds mitigations for atleast the following security issues: A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often...