Buyout's buyFractions can be called multiple time reusing the same msg.value with Multicall

Lines of code Vulnerability details Passing multiple buyFractions calls to Multicall's multicall will use the same msg.value many times. This will inflate his contribution without real fund transfers with the corresponding fund loss for the system. Proof of Concept Buyout uses Multicall: contract...

permitAndMulticall() May Be Used to Steal Funds Or as a Denial Of Service if _from Is Not The Message Sender

Lines of code Vulnerability details Impact When the from address is not the msg.sender multiCall will be made on behalf of the msg.sender. As a result each of the functions called by multiCall will be made on behalf of msg.sender and not from. If functions such as transfer or unstake are called...

batched delegate calls used can result in double spending bug

Lines of code Vulnerability details Impact In TWABDelegator.sol anyone can call the multicall function which then calls multicall in PermitAndMulticall.sol. When using batched delegatecalls the msg.sender and msg.value are not updated on every iteration and this can result in double spending bugs...

OracleVM 3.4 : xen (OVMSA-2017-0116)

The remote OracleVM system is missing necessary patches to address critical security updates : - BUILDINFO: xen commit=74b662e79bc874fe8ad8a93d2891e6569c380004 - BUILDINFO: QEMU upstream commit=8bff6989bd0bafcc0ddf859c23ce6a2ff21a80ff - BUILDINFO: QEMU traditional...

x86: 64bit PV guest breakout via pagetable use-after-mode-change

ISSUE DESCRIPTION 64-bit PV guests typically use separate root page tables for their kernel and user modes. Hypercalls are accessible to guest kernel context only, which certain hypercall handlers make assumptions on. The IRET hypercall replacing the identically name CPU instruction is used by...

DEBIAN-CVE-2015-7812

The hypercallcreatecontinuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service host crash via a preemptible hypercall to the multicall interface...

Design/Logic Flaw

The hypercallcreatecontinuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service host crash via a preemptible hypercall to the multicall interface...

UBUNTU-CVE-2015-7812

The hypercallcreatecontinuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service host crash via a preemptible hypercall to the multicall interface...