there is no way withdraw eth

Lines of code Vulnerability details Impact eth will be stuck inside the contract Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The text was update...

PT-2025-18865

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0-rc1-00004-g703695902cfa Description A vulnerability in the Linux kernel has been identified, where the inconsistency between i size and i disksize can trigger a kernel warning when the boot loader inode is...

Fedora 38 : perl-HTTP-Daemon (2023-748e811334)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-748e811334 advisory. 6.16 2023-02-24 03:07:14Z - Bump LWP::UserAgent to 6.37 in TestSuggests GH65 Olaf Alders ---- 6.15 2023-02-22 22:02:46Z - Fix CVE-2022-31081: Inconsistent...

CVE-2023-1264

A NULL pointer dereference vulnerability was discovered in vim's utfcptr2len function in the mbyte.c file. This issue is due to using a NULL pointer with the nested :open command. This flaw allows an attacker to trick a user into opening a specially crafted file, triggering an issue that causes a...

CVE-2023-1170

A heap-based buffer overflow vulnerability was found in Vim's utfptr2char function of the src/mbyte.c file. This flaw occurs because there is access to invalid memory with put in visual block mode. An attacker can trick a user into opening a specially crafted file, triggering an out-of-bounds rea...

CVE-2023-1175

A flaw was found in Vim. There is an incorrect calculation of buffer size issue found in Vim's yankcopyline function of the register.c file. This flaw allows illegal memory access when using virtual editing as "startspaces" goes negative. An attacker can trick a user into opening a specially...

CVE-2023-26483

A flaw was found in the gosaml2 package library. This issue may allow attackers to craft a deflate-compressed request, which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed...

wasmtime vulnerable to guest-controlled out-of-bounds read/write on x86_64

Impact Wasmtime's code generator, Cranelift, has a bug on x8664 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined 33-bit effective address. This bug means that, with default codegen settings, a wasm-controlled load/store...

Reentrancy in staking function exit

Lines of code Vulnerability details Impact The user on calling exit calls the updateReward function twice. Proof of Concept First entry is in function withdraw burn Calling the Hook beforeTokenTransfer Which in turn calls updateReward Second Entry getReward call updateReward directly Tools Used...

Winnings might be unable to catch up with prize pot

Lines of code Vulnerability details Impact Profit may become ineffective, meaning that funds are effectively stuck in the contract. Proof of Concept Funds are owned by the Lottery and the only way out is through payouts. However, since the jackpot is bound by jackpotBound the expected payout taki...

Estimated profit may drift

Lines of code Vulnerability details Impact The lottery is not sustainable over time. Excess pot calculation may drift, which either leads to insufficient payouts or a depletion of funds. Proof of Concept The payouts are calculated using an estimate of the net profit, currentNetProfit. There is...

Division before multiplication lead to truncation

Lines of code Vulnerability details Impact Calculation could result in truncation. Proof of Concept Staking.solL60-L64 : function earnedaddress account public view override returns uint256 earned return balanceOfaccount rewardPerToken - userRewardPerTokenPaidaccount / 1e18 + rewardsaccount; above...

claimPerDraw() can accounts for referrals after the ticket registration deadline

Lines of code Vulnerability details When accounting for referrals, the beforeTicketRegistrationDeadline ensure tickets cannot be purchased after the draw registration deadline. The issue is that the referral registration happens for the current draw regardless of which draw the tickets are...

Multiplier must be capped to prevent expected payout exceeding ticket price

Lines of code Vulnerability details Impact Expected payout may be greater than ticket price, bankrupting the lottery. Proof of Concept ticketsSold determines the multiplier to be used when calculating non jackpot rewards LotteryMath.solL84: bonusMulti += excessPot EXCESSBONUSALLOCATION /...

Front-running to register subdomain

Lines of code Vulnerability details Impact An attacker can Front-running createDao to register the subdomain and revert the user's transaction. Proof of Concept The createDao function is used to creates a new DAO, registers it on the DAO registry, and installs a list of plugins via the plugin set...

The minimum values of selectionMax and selectionSize are not verified when creating a lottery, which may create an unreasonable lottery

Lines of code Vulnerability details Summary src/LotterySetup.sol constructorLotterySetupParams memory lotterySetupParams if addresslotterySetupParams.token == address0 revert RewardTokenZero; if lotterySetupParams.ticketPrice == uint2560 revert TicketPriceZero; if lotterySetupParams.selectionSize...

TicketUtils#reconstructTicket is biased towards lower numbers and allows gaming of odds

Lines of code Vulnerability details Impact Probability of lower numbers is higher and odds can be gamed Proof of Concept for uint256 i = 0; i selectionSize; ++i numbersi = uint8randomNumber % currentSelectionCount; randomNumber /= currentSelectionCount; currentSelectionCount--; To determine the...

No sanity check on drawCoolDownPeriod can lead to frontrun attacks on jackpot prize

Lines of code Vulnerability details Impact During the construction of the LotterySetup, there is no sanity check on drawCoolDownPeriod. If its set to zero, then there will be no cool down period, players can buy the lottery tickets at any time until the draw. Once lottery setup is complete with...

Fixed rewards may also be cut

Lines of code Vulnerability details Impact Fixed rewards may change when packed. Proof of Concept In LotterySetup.packFixedRewards function packFixedRewardsuint256 memory rewards private view returns uint256 packed if rewards.length != selectionSize || rewards0 != 0 revert InvalidFixedRewardSetup...

Minimum referral requirement is incorrectly computed

Lines of code Vulnerability details As per the docs: Referrer rewards are allocated on a per draw basis Referrers who meet the minimum referral requirement according to the following table will be eligible for the Individual Referrer Allocation The minimum referral requirement for a draw N + 1 is...