initiator in OptionsPositionManager.executeOperation is not checked

Lines of code Vulnerability details Impact An attacker can execute flashloan pretending to be other user. Proof of Concept LendigPool.flashloan sends which user called in the parameter initiator, but it is not used in executeOperation. Tools Used Manual review. Recommended Mitigation Steps Check ...

swapExactTokensForTokens and swapTokensForExactTokens in OptionsPositionManager.sol uses UniswapV2Router01 which doesn't exist on Arbitrum

Lines of code Vulnerability details Impact The functions swapExactTokensForTokens and swapTokensForExactTokens are using UniswapV2Router01 to make swaps in different functions like closeDebt, withdrawOptionAssets or swapTokens, but that would not be possible and those function would revert. Proof...

Missing flash loan initiator check allows attacker to open trades, close trades and steal funds

Lines of code Vulnerability details Impact The attacker can close trades, partially close trades and even steal funds. Proof of Concept The OptionsPositionManager.executeOperation function is called when a flash loan is made and it can only be called by the lendingPool. The wrong assumption by th...

UNCHECKED TRANSFER

Lines of code Vulnerability details Impact Some tokens do not revert the transaction when transferFrom fails and returns False. Hence we must check the return value after calling the transfer or transferFrom function. Proof of Concept Check the last answer here: In short: Using...

Calculations like valueX8 and liquidity do not account for potential rounding errors

Lines of code Vulnerability details Impact These small inaccuracies could accumulate and cause the total supply of liquidity tokens to not exactly match the vault holdings. This could allow an attacker to potentially deposit tokens, get liquidity that is slightly higher than what they should base...

Integer underflow/overflow is possible in some of the timestamp calculations if sequenceOffset or auctionDuration are set maliciously

Lines of code Vulnerability details Impact An attacker could exploit this to make auctionElapsedTime return a low value when it should be high, thereby manipulating the reward calculation. Proof of Concept The vulnerability comes from the subtraction currentTime - sequenceOffset which could...

It is possible that function rngComplete() does not iterate through all rewards

Lines of code Vulnerability details Impact In RngRelayAuction.sol we have rngComplete: function rngComplete uint256 randomNumber, uint256 rngCompletedAt, address rewardRecipient, uint32 sequenceId, AuctionResult calldata rngAuctionResult external returns bytes32 if...

The treasury address can be updated by the contract owner to point to a malicious address after deployment

Lines of code Vulnerability details Impact Any fees or funds sent to the treasury could potentially be stolen or manipulated Proof of Concept The treasury address can be updated by the contract owner to point to a malicious address after deployment. This presents a risk as the treasury receives a...

The system is subjected to Cross-Contract Reentrancy due to Insufficient validation for tokens, source and liquidity Pairs

Lines of code Vulnerability details Impact A malicious actor can gain control of the liquidation process which can manipulate the POOL token price Proof of Concept Almost all the pieces of the protocol are open to everyone with no guard, and that can cause a serious problem. consider the followin...

Calculations like valueX8 and liquidity do not account for potential rounding errors

Lines of code Vulnerability details Impact These small inaccuracies could accumulate and cause the total supply of liquidity tokens to not exactly match the vault holdings. This could allow an attacker to potentially deposit tokens, get liquidity that is slightly higher than what they should base...

PT-2023-4516 · Tp Link · Tp-Link Tl-Wr941Nd +2

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR940N version V2 TP-Link TL-WR941ND version V5 TP-Link TL-WR841N version V8 Description: The issue is related to a buffer overflow in the /userRpm/AccessCtrlAccessRulesRpm component of TP-Link routers. This allows attackers to cau...

cleanup() does not properly handle debt repayment

Lines of code Vulnerability details Impact The cleanup... function in the PositionManager.sol contract is used to deposit remaining users assets back to ROE, repaying debt if any. However the users debt will not be repaid if the user has debt leading to loss of funds for the lenders and the proje...

CVE-2023-37581

Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need...

CVE-2023-37581 Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.

Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need...

CVE-2023-37581 Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.

Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need...

CVE-2023-37581 Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.

Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need...

CISA Releases its Cybersecurity Strategic Plan

Today, CISA released a strategic plan to lay out how we will fulfill our cybersecurity mission over the next three years. The CISA Cybersecurity Strategic Plan aligns the following nine objectives to specific enabling measures and measures of effectiveness to drive accountability: 1. Increase...

Incorrect parameter for allowedBorrow when repaying

Lines of code Vulnerability details Impact Incorrect parameter for allowedBorrow check during repayment in BigBang requires an approval that is orders of magnitudes higher than the intended amount if Alice wants to allow Bob to use their funds. This can be abused by Bob to take more collateral or...

Reentrancy vulnerability in SGLLendingCommon._removeCollateral

Lines of code Vulnerability details Impact This vulnerability could allow an attacker to withdraw collateral from the SGLLendingCommon contract without actually removing it. This could result in a loss of funds for the lender. Proof of Concept The SGLLendingCommon.removeCollateral function is...

Add access control to inti constructor like function

Lines of code Vulnerability details Impact Not adding access control to init function would allow for frontrunning and injection of malicious code Proof of Concept event MinDebtRateUpdateduint256 oldVal, uint256 newVal; /// @notice event emitted when the maximum debt rate is updated event...