abi.encodePacked() collision due to dynamic types usage that could lead to

Lines of code Vulnerability details Impact The use of abi.encodePacked could lead to collision due to the dynamic types usage. Through abi.encodePacked, Solidity supports a non-standard packed mode where: Types shorter than 32 bytes are neither zero padded nor sign extended and Dynamic types are...

withdrawReserve will revert when withdrawing tokens with on chain tx fees

Lines of code Vulnerability details Impact Function will revert when reserve is equal to amount, when the token being transferred is a fee on transfer token. Proof of Concept function withdrawReserve address to, uint104 amount external onlyDrawManager function withdrawReserve address to, uint104...

possible revert due to improper subtraction in _extendableMsgData() of LSP17Extension.sol

Lines of code Vulnerability details Impact in extendableMsgData of LSP17Extension.sol there is an arithmetic calculation msg.data:msg.data.length - 52; msg.data.length may be smaller than 52 in some instances. this can cause reverts in solidity Proof of Concept function extendableMsgData internal...

Unused returns on the ds. _withdraw(), NounsDAOLogicV3._withdraw(), and ds.executeFork()

Lines of code Vulnerability details Impact The return value of the external calls are not stores in a local variable or a state variable Proof of Concept The return values do not store the results in a store local or state variable. As a result, the computation have no effect. Code:...

Lack of check for zero address in the function _transferOwnership before transferring ownership

Lines of code Vulnerability details Impact The absence of a check for the zero address address0 when transferring ownership can lead to unintended consequences and potential fund loss. If the contract allows transferring ownership to the zero address address0, it effectively means relinquishing...

Division before Multiplication could incur unnecessary precision loss

Lines of code Vulnerability details Impact Division before multiplication could incur unnecessary precision loss causing loss of funds. Proof of Concept In the dynamicQuorumVotes function of NounsDAOV3DynamicQuorum.sol contract the value of againstVotesBPS is first calculated by dividing a value ...

Proposal can executed even when it is in the "Queued" state.

Lines of code Vulnerability details Impact An attacker can bypass the intended governance process and directly execute proposals that are still in the voting or canceled state. This can result in unauthorized actions being performed on the smart contract, leading to loss of funds Proof of Concept...

sendProRataTreasury() in NounsDAOV3Fork.sol can cause reverts in functions where it is called.

Lines of code Vulnerability details Impact sendProRataTreasury calls timelock.sendEth to send eth, timelock is a NounsDAOExecutorV2 contract. In NounsDAOExecutorV2.sendEth, it only allows calls from the address set to be admin in the NounsDAOExecutorV2 contract. NounsDAOV3Fork library is used in...

Vetoer has too huge privileges which allow to burn veto power and change his/her address

Lines of code Vulnerability details Impact Only a current user with veto power can either change vetoer or pernamently destroy veto power forever. Since this functions are crucial for governance, they should also be called by admin. In the current scenario, vetoer has some higher privileges in...

ds._proposals mapping is never updated when a new proposal is created via propose() in NounsDAOV3Proposals.sol

Lines of code Vulnerability details Impact in function propose, after a new proposal is created, the ds.proposals variable in storage is never updated. Natspec comments for StorageV3 struct definition in NounsDAOInterfaces.sol says that ds.proposals is a mapping that contains references to all...

executeTransaction function allows executing a queued transaction.

Lines of code Vulnerability details Impact The executeTransaction function allows executing a queued transaction. It requires the caller to be the admin, verifies the transaction's queue status and time lock, and executes the transaction. The use of target.call this can be exploit it by an attack...

Vetoed proposals still can be execute or queued

Lines of code Vulnerability details Impact Function veto does not change the state of the proposal. This means, that when a proposal is in a ProposalState.Queued state and then vetoed - it, still can be executed. The same occurs for proposals in ProposalState.Succeeded state - even after being...

PT-2023-8134 · Microsoft · Office Word +8

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions prior to the January 9, 2024 security update Office 2019 Office 2021 Office LTSC for Mac 2021 Microsoft 365 Description: A security issue exists in FBX that could lead to remote code execution. The vulnerability is...

The fork escrow voting should use the snapshot mechanism to save whether the current DAO state reaches the fork threshold

Lines of code Vulnerability details Impact The fork escrow vote does not use the snapshot mechanism or checkpoint mechanism to save whether the current DAO state reaches the fork threshold, which may cause the timing of the fork to be missed. Proof of Concept Suppose the following scenario: 1. Wh...

Functions will always return success even if it is failed

Lines of code Vulnerability details Impact In NounsAuctionHouseFork.sol, safeTransferETH function is used to transfer ETH. File: nouns-contracts/contracts/governance/fork/newdao/NounsAuctionHouseFork.sol 272 function safeTransferETHaddress to, uint256 value internal returns bool 273 bool success,...

DoS by cancelling newly created proposals

Lines of code Vulnerability details Impact Malicious user can cancel any freshly created proposal, thus making the goverence not usuable to anyone. Whenever new proposal is being created, a malicious actor can cancel it. Proof of Concept Function cancel is external, thus it can be called by anyon...

ABI encodePacked Collision

Lines of code Vulnerability details Impact Collision occurs Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Do not use more than one dynamic type in...

Attacker can drain the forked DAO's ERC20s by supplying a list with dupes to quit()

Lines of code Vulnerability details The quit function is used to allow members of the forked DAO to ragequit the dao and receive a pro-rata share of the ERC20 tokens that the DAO holds. One version of this functions allows the user to supply their own list of ERC20 tokens for the function to...

Office and Windows HTML Remote Code Execution Vulnerability (CVE-2023-36884) Mitigation

The remote system may be vulnerable to CVE-2023-36884 since it does not have the correct FEATUREBLOCKCROSSPROTOCOLFILENAVIGATION registry key mitigations applied as referenced in the vendor advisory. An unauthenticated, remote attacker could exploit this, by using specially-crafted Microsoft Offi...

Setting ownership to zero account in the function _renounceOwnership()

Lines of code Vulnerability details Impact In the renounceOwnership function, the call to setOwneraddress0 sets the owner address of the contract to address0, which represents the zero address in Ethereum. This effectively removes the ownership of the contract, as the zero address is not a valid...