CVE-2023-25841 BUG-000158075 Stored XSS issue in ArcGIS Server

There is a stored Cross-site Scripting vulnerability in Esri ArcGIS Server versions 11.0 and below on Windows and Linux platforms that may allow a remote, unauthenticated attacker to create crafted content which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

Honest users could lose funds due to the current implementation of executeProposal()

Lines of code Vulnerability details Impact In the InterChainGovernance.sol contract, the executeProposal function lacks an explicit check to ensure that the msg.value provided with the function call is greater than or equal to the nativeValue specified. After an extensive discussion with the...

InterchainProposalExecutor doesn't support actions with value

Lines of code Vulnerability details Impact An interchain call consists of the target address, calldata, and value. When InterchainProposalExecutor performs the call, it passes the value along function executeProposalInterchainCalls.Call memory calls internal for uint256 i = 0; i calls.length; i++...

Insecure minimum threshold in _rotateSigners function

Lines of code Vulnerability details Impact Insecure minimum threshold in rotateSigners function can cause execution of malicious multisig proposals with unexpected results. Proof of Concept The rotateSigners is the only function which can initialize multisig parameters. This function has zero che...

[H] Users can lose their funds if the transaction reverts on destination chain

Lines of code Vulnerability details Impact The transmitSendToken function in the contract facilitates cross-chain token transfers. For contracts involving ERC20 tokens it is also expected that, should a contract call fail, one's tokens are not lost/transferred elsewhere. However, the function doe...

The is no way for native tokens to get sent to InterchainProposalExecutor

Lines of code Vulnerability details Impact Proposals that require value cannot be executed as native tokens on the other side of the bridge cannot be provided. Proof of Concept Proposals have a value parameter, which allows users to specify what amount of native tokens should be passed when calli...

InterchainProposalExecutor will fail if any proposal requires value transfer, breaking core logic

Lines of code Vulnerability details Impact Proposals which are sent from a source chain using InterchainProposalSender to a destination chain to be executed using InterchainProposalExecutor are intended to support function calls that include transfers of ETH, or other native token. However, the...

sendToken() shouldn't have metadata parameter

Lines of code Vulnerability details Impact Users calling sendToken with metadata may trigger a revert or lose the calldata if its size is 1-3 bytes when the destination is an EOA. Proof of Concept In transmitSendToken, we discard the calldata if it's less than 4 bytes, and revert if it's bigger o...

AxelarGateway.sol: external setup funtion allow anyone to set governance_, mintLimiter_ and operator

Lines of code Vulnerability details Impact Anyone can call through the setup function and pass the params to set the mintlimiter, operator and governance. Proof of Concept As we can in above link, the setup function is called to set the mint limiter, operator and governance address. As per natsc...

ProposalHash can be easily duplicated with same target, callData and nativeValue

Lines of code Vulnerability details Impact function executeMultisigProposal address target, bytes calldata callData, uint256 nativeValue external payable onlySigners bytes32 proposalHash = keccak256abi.encodePackedtarget, callData, nativeValue; if !multisigApprovalsproposalHash revert NotApproved...

Proposal cannot be executed if signers update their accounts and threshold halfway

Lines of code Vulnerability details Impact If signers update their accounts and threshold halfway into voting, then the proposal cannot be executed anymore Proof of Concept execute is protected under onlySigners function execute address target, bytes calldata callData, uint256 nativeValue -...

Users do not get charged for the value their proposal will need

Lines of code Vulnerability details Impact Depending on whether the destination chain InterchainProposalExecutor's native token balance the transaction will either steal funds or will fail. Proof of Concept Users can provide an amount of native tokens they want to send to the call they will make ...

Permits may be reused after token upgrade

Lines of code Vulnerability details Impact The StandardizedToken contract inherits the ERC20Permit contract which in the case of an upgradable/proxied Token would allow permits for a previous version of the Token to be used on any subsequent version of it. NOTE that ERC20Permit is not explicitly ...

bypass flow limit by transferring tokens at epoch's boarder

Lines of code Vulnerability details Impact Token flow can reach 2flowlimit in a very short time. Proof of Concept We store the flow out and flow in tokens numbers for every epoch: / @dev Returns the slot which is used to get the flow out amount for a specific epoch @param epoch The epoch to get t...

Reentrant Call Vulnerability in ExpressCallHandler Contract

Lines of code Vulnerability details DISCRIPTION The ExpressCallHandler contract contains a potential bug related to handling the express calls. The issue lies in the setExpressReceiveToken and setExpressReceiveTokenWithData functions. Specifically, these functions don't properly handle reentrant...

newGovernance COULD BE SET TO A WRONG ADDRESS THUS FREEZING CERTAIN FUNCTIONS

Lines of code Vulnerability details Impact The AxelarGateway.transferGovernance function is used to set the newGovernance address in the storage of the AxelarGateway contract. It is performed as follows: function transferGovernanceaddress newGovernance external override onlyGovernance if...

balance of the recipient to is updated after the token transfer (safeTransferFrom function) could lead to reentrancy attack

Lines of code Vulnerability details Impact The balance of the recipient to is updated after the token transfer safeTransferFrom function. If the safeTransferFrom function triggers an external contract, and that contract, in turn, calls back to this contract, it can result in a reentrancy attack...

Collateralization ratio manipulation can cause a denial of service

Lines of code Vulnerability details Impact Stablecoin redeeming and profit accruing in the SavingsVest contract can be blocked when the collateralization ratio has overflown. Proof of Concept The mitigation recommended in 31 and implemented by the sponsor in this commit doesn't resolve the root...

M-06 Unmitigated

Lines of code Vulnerability details Original Issue code-423n4/2023-06-angle-findings13 Details This issue shows users may lose a portion of yield when protocolSafetyFee and vestingPeriod are changed. As mitigation, it recommends accruing interests before those parameters are changed. Mitigation P...

Replay Attack Vulnerability Due to Uniqueness Invariant Violation in AxelarServiceGovernance Contract's Proposal Hash Generation

Lines of code Vulnerability details Impact The current implementation of the AxelarServiceGovernance contract relies solely on the Keccak256 algorithm to generate proposal hashes, using only the target contract's address, encoded function call data, and the native token transfer value as...