Marketplace may call onERC721Received() and create a lien during buyNftFromMarket(), creating divergence

Lines of code Vulnerability details Impact The contract supports a "push-based" NFT supply, where the price and rate are embedded in the data bytes. This way, the lender doesn't need to additionally approve the NFT but can just transfer it directly to the contract. However, since the contract als...

addCredit() impacts the price curve of loan auctions

Lines of code Vulnerability details Impact The price curve of a loan auction is supposed to depend only on block.timestamp, meaning that the price increases as time goes on. However, the addCredit function allows anyone to change or increase the value of lien.credit. If lien.credit is increased,...

DoS of auctionBuyNft()

Lines of code Vulnerability details Impact An auction can be forced to conclude, which is typically to the benefit of the lender. Proof of Concept auctionBuyNftlien, lienId, tokenId, amount validates the lien in question by validateLienlien, lienId which checks that the lien is hashed to the same...

auctionBuyNft() borrower can block the bidding

Lines of code Vulnerability details Impact borrower can block the bidding Proof of Concept auctionBuyNft When the bid is successful and there is an extra amount, it will be refunded to borrower The code is as follows: function auctionBuyNft Lien calldata lien, uint256 lienId, uint256 tokenId,...

Wrong assumption that NFT is not in contract when loan is active

Lines of code Vulnerability details Impact The lender might lose or be robbed of his supplied NFT. Proof of Concept A lender can withdraw the NFT in his lien if it is not currently on loan by calling withdrawNftWithInterest. This is checked by relying on IRC721.safeTransferFrom to revert if the N...

New treasury rate should not affect existing loan

Lines of code Vulnerability details Impact In the protocol, lenders have to pay a small treasury fee when they claim their interest. The contract owner can change this treasuryRate at any time using the function setTreasuryRate. // @audit treasury rate should not affect existing loan function...

DoS of liquidation

Lines of code Vulnerability details Impact The lender can be prevented from liquidating the borrower, at negligible cost to the borrower. Proof of Concept When the borrower is insolvent the lender can liquidate him by withdrawEthWithInterestlien, lienId. The parameters are verified by the modifie...

_initiateBridgeERC20() does not check if _remoteToken is valid. When the message send to L2, it will cause user lossing funds in L1

Lines of code Vulnerability details Impact initiateBridgeERC20 does not check if remoteToken is valid. When the message send to L2, it will cause user lossing funds in L1 Proof of Concept As we can see, theinitiateBridgeERC20 just check isOptimismMintableERC20localToken,if valid ,it will call...

Borrower can reject receiving ETH thus prevent lender from calling withdrawEthWithInterest()

Lines of code Vulnerability details Impact The withdrawEthWithInterest function transfers ETH with interest back to the lender in case the loan is insolvent or the auction has concluded. It also transfers PnL to the borrower. However, if the borrower is a smart contract and rejects receiving ETH,...

If no funds are deposited at the beginning, L1-L2 cannot be transferred out

Lines of code Vulnerability details Impact If user transfer tokenA-tokenB from L1 to L2, and the L2 depositstokenBtokenA is zero at the beginning.It will cause user lossing his funds. Proof of Concept First, user transfer TokenA, and it will send Message to L2 and L2 will call finalizeBridgeERC20...

Wrong assumption in function withdrawNftWithInterest() could allow lender to withdraw NFT from active loan

Lines of code Vulnerability details Impact In the withdrawNftWithInterest function, the lender can withdraw an NFT back if the NFT is currently in the contract without an active loan. However, the function makes an incorrect assumption that if the NFT can be withdrawn, then the loan is not active...

Borrowing without paying interest

Lines of code Vulnerability details Impact A lender can be prevented from withdrawing from his lien, without having to pay him interest. Only a few negligible wei have to be paid for technical reasons. This enables the trader to open a risk free position. Long: The trader swaps the NFT in the lie...

smaillroofing.com Cross Site Scripting vulnerability OBB-3372675

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Advantech WebAccess/SCADA

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Advantech Equipment: WebAccess Node Vulnerabilities: Improper Control of Generation of Code 'Code Injection', Unrestricted Upload of File with Dangerous Type 2. RISK EVALUATION Successful exploitation...

NOT CONFIRMED

Lines of code L1 Vulnerability details MITIGATED Assessed type Under/Overflow --- The text was updated successfully, but these errors were encountered: All reactions...

teteat

Lines of code L1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assess...

rwar

Lines of code L1 Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps Assess...

Security Bulletin: There are several vulnerabilities in jackson-databind used by IBM Maximo Asset Management (CVE-2022-42003, CVE-2022-42004, CVE-2020-36518)

Summary There are several vulnerabilities in jackson-databind used by IBM Maximo Asset Management. Vulnerability Details CVEID:CVE-2022-42003 DESCRIPTION: FasterXML jackson-databind is vulnerable to a denial of service, caused by a lack of a check in the primitive value deserializers when the...

PT-2023-24611 · Unknown +1 · Formcreator +1

Name of the Vulnerable Software and Affected Versions: Formcreator versions 2.13.5 and prior Description: A stored cross-site scripting issue is present in the Formcreator plugin, potentially allowing arbitrary javascript code execution in an admin or tech context. This is due to the use of...

Code injection

JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes ' in HTML, allowing an attacker to inject malicious code. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of other users...