StRSR.cancelUnstake doesn't call _payoutRewards before minting new shares

Lines of code Vulnerability details Impact StRSR.cancelUnstake doesn't call payoutRewards before minting new shares. As result this rewards will be distributed for new staker as well. Proof of Concept If user wants to cancel his withdraw, then he can call StRSR.cancelUnstake and mint new shares...

tryCatchLimit can forward less than the specified gasLimit due to how CALL* opcode forward gas

Lines of code Vulnerability details Description To understand the issue I strongly recommend the lecture of this article. In particular, sections "Insufficient Gas Griefing Attack" and "Workaround Against “Insuficient Gas Griefing attack”". The problem relays on the fact that we cannot be sure th...

RecollateralizationLibP1.basketRange calculates deficit incorrectly

Lines of code Vulnerability details Impact RecollateralizationLibP1.basketRange calculates deficit incorrectly. so recollateralization may be not efficient. Proof of Concept RecollateralizationLibP1.basketRange calculates range.bottom for pessimistic case. // tok = tok/BU BU uint192 anchor =...

Inadequate error handling

Lines of code Vulnerability details Summary This report highlights a high vulnerability related to inadequate error handling in the code under review. Vulnerability Details The code lacks proper error handling in certain functions. Specifically, when errors occur, such as in the swapCoins functio...

M-02 Unmitigated

Lines of code Vulnerability details Mitigation of M-02: Issue partially mitigated, see comments Link to Issue: code-423n4/2023-05-ambire-findings18 Comments While the issue mentioned in M-02 has been technically mitigated, the same attack can be performed in another function present in the wallet...

User who stakes into StRSRVotes doesn't have any voting power

Lines of code Vulnerability details Impact User who stakes into StRSRVotes doesn't have any voting power. This is not intuitive clear and user who thinks that he can vote, actually will not be able until he will delegate votes to himself. Proof of Concept StRSRVotes contract extends StRSR which h...

AssetRegistry.swapRegistered can be called with low gas to make basket be disabled

Lines of code Vulnerability details Impact Attacker can disable basket, when swapping or unregistering not basket asset. Proof of Concept AssetRegistry.swapRegistered and AssetRegistry.unregister are both functions that can be called by governance only. It's possible that after proposal is passed...

DefaultMaxSwapAmount is 10x higher than spec for ETH

Lines of code Vulnerability details Impact In the "coinswap" module a limit is in place for avoiding large swaps and their potential to manipulate the price in a low-liquidity scenario. The spec says: For risk management purposes, a swap will fail if the input coin amount exceeds a pre-defined...

M-01 Unmitigated

Lines of code Vulnerability details Mitigation of M-01: Issue not mitigated Link to Issue: code-423n4/2023-05-ambire-findings21 Comments Sponsor decided not to mitigate the issue. Assessed type Other --- The text was updated successfully, but these errors were encountered: All reactions...

GHSA-8RC9-VXJH-QJF2 Vega's validators able to submit duplicate transactions

A vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For example, a deposit to the collateral bridge for 100USDT that credits a party’s general account on Vega, can be re-processed 50 times resultin...

Advantech R-SeeNet

1. EXECUTIVE SUMMARY ​CVSS v3 9.8 ​ATTENTION: Exploitable remotely/low attack complexity ​Vendor: Advantech ​Equipment: R-SeeNet ​Vulnerability: Hard Coded Password, External Control of File Name or Path 2. RISK EVALUATION ​Successful exploitation of these vulnerabilities could allow an attacker...

Enphase Envoy

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Enphase Equipment: Envoy Vulnerability: OS Command Injection 2. UPDATE OR REPOSTED INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-23-171-01 Enphase Envoy that was...

PT-2023-20625 · Ox Software Gmbh +1 · Ox App Suite +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue arises from control characters not being removed when exporting user feedback content, allowing attackers to include unexpected content and potentially break the exported data...

M-05 Unmitigated

Lines of code Vulnerability details Mitigation of M-05: Issue NOT mitigated Mitigated issue M-05: Virgin stake can claim all drops Fix: code-423n4/2023-05-xeth@aebc324 The issue is that if dripping is enabled when totalSupply == 0 the entire amount dripped will immediately accrue to the first...

M-10 Unmitigated

Lines of code Vulnerability details Mitigation of M-10: Issue NOT mitigated Mitigated issue M-10: First 1 wei deposit can produce lose of user xETH funds in wxETH Fix: code-423n4/2023-05-xeth@fbb2972 The issue is similar to the standard inflation attack, except that instead of the attacker's...

CVE-2023-3312

A vulnerability was found in drivers/cpufreq/qcom-cpufreq-hw.c in the cpufreq subsystem of the Linux Kernel. During device unbind, this issue will cause a double release problem, leading to a denial of service. Mitigation Mitigation for this issue is either not available or the currently availabl...

WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

Software Dokan Type Plugin Vulnerable versions = 3.7.19 Fixed in 3.7.20 OWASP Top 10 A8: Insecure Deserialization Classification PHP Object Injection CVE CVE-2023-34382 Patch priority Medium CVSS severity Medium 4.4 Developer Claim ownership PSID e06401ebc804 Credits Theodoros Malachias Required...

M-07 Unmitigated

Lines of code Vulnerability details Comments The very first point that needs to be made, is that, according to the Mitigation Review details: In production we have planned to use MEV Protection services such as flashbots rpc The MEV Protection rpc ensure the rebalance and defender won't be affect...

Ubuntu: Security Advisory (USN-6171-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces

Context Content Security Policies CSP are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack. Impact There aren't any XSS attack vectors via...