20764 matches found
Huge over calculating user rewards
Lines of code Vulnerability details Impact Huge over calculating user rewards When user claim rewards for the first time rewards over calculated Proof of Concept getPoolReward function uses ''uint256 timeSinceReward = block.timestamp - lastRewardTime'' formula to calculate period of time that...
the S1 Citizen and S2 Citizen loops in the second getStakerPositions are not working properly
Lines of code Vulnerability details Impact This can result in the second loop not running correctly and resulting in an error in the logic, in case if the length of the stakerS1Positionstaker or stakerS2Positionstaker arrays is very large, the operation of adding or subtracting the index on...
share underflow in getPoolReward()
Lines of code Vulnerability details Impact It is important to draw attention to an issue that, while out of scope, can lead to a complete loss of funds on the contract and, therefore, seems significant. The configurePools function allows setting an arbitrary, unrestricted daoTax, which can result...
Use safeTransferFrom() instead of transferFrom() in function NeoTokyoStaker._assetTransferFrom()
Lines of code Vulnerability details Impact Some ERC-20 tokens do not revert on failure such as ZRX. Instead, they would just return a boolean false. In function NeoTokyoStaker.assetTransferFrom, the check success is only checking whether the low-level call is successful or not. If the ERC-20 toke...
LP tokens without 18 decimals are not supported
Lines of code Vulnerability details Impact If the LP token used does not have 18 decimals, staking rewards for LP tokens will be much more or much less than intended. Vulnerability Details In stakeLP and withdrawLP, the formulas for calculating points are as shown: NeoTokyoStaker.solL1155 uint256...
Total reward is miscalculating
Lines of code Vulnerability details Impact In the getPoolReward the calcul of totalReward is wrong because the rewardRate is not updated. When block.timestamp is less or equal to windows.startTime the reward rate should equal to the current window rate not the previous one. Proof of Concept...
Newly staked LP tokens' end time can overwrite previously staked LP tokens' end time
Lines of code Vulnerability details Impact When the following NeoTokyoStaker.stakeLP function is called for the first time to stake some LP tokens, stakerLPPositionmsg.sender.timelockEndTime = block.timestamp + timelockDuration is executed. Then, calling this function for a second time to stake...
Possible loss of rewards when staking non-component vaults
Lines of code Vulnerability details Impact Users could gain less rewards if they stake a non-component vault, as compared to reassembling their S1 Citizen with the vault and and staking it as a component vault. Vulnerability Details From the repository's README.md: S1 Citizens without a component...
Wrong accounting of share leading to incorrect amount of BYTES be minted per second
Lines of code Vulnerability details Impact In NeoTokyoStaker, staker is a competitive system where stakers compete for a fixed emission rate in each of the S1 Citizen, S2 Citizen, and LP token staking pools. For each staking pool, there are some reward windows. Each reward window has different...
Unvalidated input in setManagerRight function
Lines of code Vulnerability details Impact The setManagerRight function takes managedRight and managerRight as inputs without validating them This could potentially lead to unexpected results if the input values are not what the function expects. Tools Used Recommended Mitigation Steps Provide...
# configureLP function should check LP stakers present before changing LP address.
Lines of code Vulnerability details configureLP function should check LP stakers existence before changing LP address. Permitted users are allowed to change LP address when lpLocked is false. So this does not follow the comments above. Proof of concept 1701 This function allows a permitted user t...
wrong updating lp position
Lines of code Vulnerability details Impact lock lp token at staking more than required when user adds some lp token staking amount, contract uses new timelockEndTime for previously staked amount . Proof of Concept Scenario : user have some amount of lp token staked for a period of time like 30 da...
User Rewards will be lost in case of Withdraw
Lines of code Vulnerability details Impact User loses his unclaimed rewards If user withdraw all of his staked tokens he won't be able to claim rewards Proof of Concept the point is used to calculate user rewards and when a user withdraw all of its staked tokens the point will be set to zero and...
Lenovo System Update Elevation of Privileges Vulnerability - Lenovo Support US
No description provided...
Lenovo XClarity Controller (XCC) Vulnerabilities - Lenovo Support US
No description provided...
CVE-2023-29324
creationtimestamp| type| source ---|---|--- 2023-03-14 12:00:00+00:00| seen| https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/ 2023-05-09 22:45:04+00:00| seen| https://t.me/cibsecurity/63684 2023-05-10 04:00:00+00:00| seen|...
CVE-2023-23397
creationtimestamp| type| source ---|---|--- 2023-03-14 12:00:00+00:00| seen| https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/ 2023-03-14 18:19:43+00:00| seen| https://t.me/alexmakus/4936 2023-03-14 19:23:27+00:00| seen|...
CVE-2023-1382
A data race flaw was found in the Linux kernel, between where con is allocated and con-sock is set. This issue leads to a NULL pointer dereference when accessing con-sock-sk in net/tipc/topsrv.c in the tipc protocol in the Linux kernel. Mitigation This flaw can be mitigated by preventing the...
CVE-2023-28327
A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unixdiaggetexact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service. Mitigation Mitigation fo...
