Malicious code in money-market (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dedeeaef1320ee7c4678cb40bbcca7a1b3bc489c5e09c075ffeab78eb04dd1b Any computer that has this package installed or running should be considered...

MAL-2025-673 Malicious code in money-market (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dedeeaef1320ee7c4678cb40bbcca7a1b3bc489c5e09c075ffeab78eb04dd1b Any computer that has this package installed or running should be considered...

Lack of minimal sufficient liquidity check can result in unreliable prices

Lines of code Vulnerability details function getPriceCantoaddress token internal view returnsuint erc20 token = erc20token; address pair = pairForaddresswcanto, addresstoken, false; if !isPairpair return 0; // this pair does not exist with Canto uint decimals = 10 token.decimals; // get decimals ...

Missing allowlist checks on tokens in CrossAnchorBridge could cause loss of funds

Lines of code Vulnerability details Impact The CrossAnchorBridge contract accepts any ERC20 token and transfers them to the wormhole bridge. There were allowlist checks on the tokens before, but they were commented out in this version for the audit. If a user transfers, for example, non-supported...

[WP-H3] money-market-contracts/oracle#feed_prices() delayed transaction may disrupt price feeds

Lines of code Vulnerability details The implementation only takes two attributes: asset and price. And the lastupdatedtime of the record will always be set to the current block.time. This makes it possible for the price feeds to be disrupted when the network is congested, or the endpoint is down...

Simple interest calculation is not exact

Lines of code Vulnerability details Impact The borrow rate uses a simple interest formula to compute the accrued debt, instead of a compounding formula. pub fn computeinterestraw state: &mut State, blockheight: u64, balance: Uint256, aterrasupply: Uint256, borrowrate: Decimal256, targetdepositrat...

[WP-H2] money-market-contracts/contracts/market claim_rewards may revert due to spend_limit set on distributor

Lines of code Vulnerability details While claimrewards from the money-market, it calls the distributorcontractspend to send the rewards. let messages: Vec = if !claimamount.iszero vec!CosmosMsg::WasmWasmMsg::Execute contractaddr: deps .api .addrhumanize&config.distributorcontract? .tostring, fund...