The processBlock() function does the wrapping process wrongly

Lines of code Vulnerability details Impact The blocking process in the FollowNFT contract needs to wrap it first, but it does the wrapping process wrongly. wrapping process in wrap function update some statement and then mint token but if you look at processBlock function, it's just mint token an...

Incorrect liquidity calculations if snapshot errors occur

Lines of code Vulnerability details Impact incorrect liquidity values that undermine the risk checks and constraints of the protocol Proof of Concept getHypotheticalAccountLiquidityInternal does not handle snapshot errors properly. Specifically: It calls MToken.getAccountSnapshot to get the...

approve() can be front-run

Lines of code Vulnerability details Impact In MToken.sol we have approve function: function approveaddress spender, uint256 amount override external returns bool address src = msg.sender; transferAllowancessrcspender = amount; emit Approvalsrc, spender, amount; ...

missing check for the max/min price in the chainlinkOracle.sol contract

Lines of code Vulnerability details Impact the chainlinkOracle.sol contract specially the getChainlinkPrice function using the aggregator v2 and v3 to get/call the latestRoundData. the function should check for the min and max amount return to prevent some case happen, something like this: if cas...

The owner can call _upgrade directly, skipping executeLensV2Upgrade.

Lines of code Vulnerability details Impact Loss of funds due to skipped checks before transfers Invalid system state due to assuming conditions not verified Hiding failed upgrade due to skipped revert/events Proof of Concept upgrade is missing an onlyOwner modifier By calling upgrade directly, th...

No Receive functiion in TemporalGovernor contract

Lines of code Vulnerability details Impact The function executeProposal in TemporalGovernor contract will fail, if there is a value to send with the call to the targets executeProposal function could send native token out along with a call to the targets encoded in vm.payload, but the current...

function _queueProposal not checking if the required time is passed to allow proposal to set to the queue list

Lines of code Vulnerability details Impact in the queueProposal function there is no check for if the requested time is passed to allow queue the proposal. in this case any proposal after creating can be added to the queue list. Proof of Concept the TemporalGovernor.sol contract have a variable...

[ H ] Infinite loop in calculateNewIndex prevents tokens from being minted and rewards from being distributed

Lines of code Vulnerability details Impact Recursive calls from calculateNewIndex in MultiRewardDistributor will result in an infinite loop and out of gas errors, preventing tokens from being minted and rewards being sent to some users as disburseSupplierRewardsInternal will not be called. Proof ...

In LensBaseERC721.sol#_transfer() Lack of check from==to

Lines of code Vulnerability details Impact In LensBaseERC721.soltransfer balances of from and to are stored in temporary variables and after the subtration, addition operation the results are written to storage. In the second operation since the original balance is used in the addition operation,...

safe32 WILL RESTRICT THE DURATION OF MultiRewardDistributor._addEmissionConfig FUNCTION USABILITY

Lines of code Vulnerability details Impact The MultiRewardDistributor.addEmissionConfig function is used to add a new emission configuration for a specific market. The addEmissionConfig function constructs the MarketConfig configuration struct using the input parameters to the function. The...

Possible integer underflow

Lines of code Vulnerability details Impact The previous FollowNFT implementation is different between v1.3 and v2.0. The followerCount is 0 for existing FollowNFTeven if lastFollowTokenId is not 0 after upgrade. // Old uint256 lastFollowTokenId slot splitted into two uint128s to include...

liquidateBorrow() mTokens that do not enter the market can still be liquidated as collateral

Lines of code Vulnerability details Impact borrower's mTokens that do not join the market, but it still be Liquidation as collateral Proof of Concept If user wants to use mToken as collateral, the user needs to enter market with enterMarket function. / @notice Add assets to be included in account...

Migration of Profiles can fail due to existance of same handle

Lines of code Vulnerability details Impact Some profiles cannot be migrated to V2 if their handle tokenId has already been minted. Proof of Concept A handle can be minted in the LensHandles contract before a profile that would have the same handle is migrated from V1. When the profile attempts to...

the unbounded approve function allows a front-running vulnerability due to setting unlimited allowance.

Lines of code Vulnerability details Impact if approve is called with a very high allowance, the spender can drain the owner's entire balance. Proof of Concept approve allows setting an allowance to any arbitrary uint256 value, including typeuint.max. This effectively gives unlimited approval to t...

Users repay more than the approved amount.

Lines of code Vulnerability details Impact More tokens can be repaid than were approved leading to loss of funds Proof of Concept The repayBorrowFresh function does the following: 1. Checks if repay is allowed by calling comptroller.repayBorrowAllowed with the input repayAmount. 2. Fetches the...

CVE-2023-4004

A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nftpipaporemove function with the element, without a NFTSETEXTKEYEND. This issue could allow a local user to crash the system or potentially escalate their privileges on the system. Mitigation This flaw...

Missing owner check on from when transferring tokens

Lines of code Vulnerability details Impact The LensBaseERC721.transferFrom/safeTransferFrom/burn they check approvals on msg.sender through isApprovedOrOwnermsg.sender, tokenId, it is never checked that the specified from parameter is actually the owner of the NFT. An attacker can decrease other...

wrap after unfollow is enabled

Lines of code Vulnerability details Impact wrap after unfollownft is enabled , cause many problems Proof of Concept by design, wrap after unfollowed is not allowed,but it seems that it's possible due to lack of limitation. poc below: add below script in FollowNFTTest.t.sol //forge test --match-te...

CVE-2023-36542

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission fo...

CVE-2023-36542

Apache NiFi versions 0.0.2 through 1.22.0 are vulnerable to a code injection flaw because certain Processors and Controller Services support HTTP URL references for retrieving drivers. An authenticated and authorized user can exploit this by configuring a location that enables custom code executi...