Attacker can force AuctionCrowdfunds to bid their entire contribution up to maxBid

Lines of code Vulnerability details Description AuctionCrowdfund's bid allows any user to compete on an auction on the party's behalf. The code in bid forbids placing a bid if party is already winning the auction: if market.getCurrentHighestBidderauctionId == addressthis revert...

[NAZ-M3] Use safeTransferFrom() instead of transferFrom() for ERC721 transfers

Lines of code Vulnerability details Impact The transferFrom method is used instead of safeTransferFrom, presumably to save gas. I however argue that this isn’t recommended because: OpenZeppelin’s documentation discourages the use of transferFrom, use safeTransferFrom whenever possible. Given that...

A majority attack can easily bypass Zora auction stage in OpenseaProposal and steal the NFT from the party.

Lines of code Vulnerability details Description The PartyGovernance system has many defenses in place to protect against a majority holder stealing the NFT. One of the main protections is that before listing the NFT on Opensea for a proposal-supplied price, it must first try to be auctioned off o...

BuyCrowdfund.buy lacks access control

Lines of code Vulnerability details Impact Anyone can call BuyCrowdfund.buy and BuyCrowdfund.buy will call any function at any address and can send eth up to maximumPriceWhen maximumPrice is 0, all ETH in the contract can be sent. Consider maximumPrice = 70 ETH, the current seller's listing price...

ArbitraryCallsProposal.sol and ListOnOpenseaProposal.sol safeguards can be bypassed by cancelling in-progress proposal allowing the majority to steal NFT

Lines of code Vulnerability details Note: PartyDAO acknowledges that "canceling an InProgress proposal mid-step can leave the governance party in a vulnerable or undesirable state because there is no cleanup logic run during a cancel" in the "Known Issues / Topics" section of the contest readme. ...

Governance NFT Voting power can be distributed unfairly after the party purchase the NFT because voting power distribution depends on the contribution NFT burning order

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Voting power can be distributed unfairly after the party purchase the NFT because voting power distribution depends on the contribution NFT burning order. For example, the NFT is purchased at price 1.5...

Malicious party active member can approve malicious contract to spend and steal party ERC1155 nft and ERC20 tokens via arbitrary proposal execution

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Let's look into the implementation in ArbitraryCallsProposal.sol // Check that the call is not prohibited. if !isCallAllowedcall, isUnanimous, preciousTokens, preciousTokenIds revert...

# _safeMint() should be used rather than _mint() wherever possible

Lines of code Vulnerability details safeMint should be used rather than mint wherever possible Impact In Token.sol.sol, eventually it is called ERC721 mint. Calling mint this way does not ensure that the receiver of the NFT is able to accept them, making possible to lose them. safeMint should be...

Use safeTransfer to send ERC721 tokens

Lines of code Vulnerability details Impact Winner of the auction can lose his NFT Proof of Concept When you settle and auction you transfer the NFT using transferFrom token.transferFromaddressthis, auction.highestBidder, auction.tokenId; Maybe this is just an intended behaviour and is the...

Attacker can gain more voting power

Lines of code Vulnerability details Impact An attacker can gain more voting power at a low cost Proof of Concept When voting, voting power is taken from the snapshot at the same block as the proposal was created. The attacker can monitor mempool and borrow NFTs just in time when proposal is made...

User can generate unlimited votes through faulty transfer logic

Lines of code Vulnerability details Impact When tokens are transferred from one user to another, votes should be moved from the delegatee of the sender to the delegatee of the receiver. Instead, they are transferred from the sender to the receiver. Because the moveDelegateVotes function is...

NFT could be locked in settlement

Lines of code Vulnerability details Impact transferFrom is used to transfer NFT in settlement. If the receiver is a contract without appropriate way to handle the NFT, the NFT might be locked in there and non retrievable. Proof of Concept There is no check if the receiver can deal with NFT if it ...

NFT flashloan against governance voting

Lines of code Vulnerability details Impact Specifically, to support a proposal, the voting power is counted at the time of the proposal creation time. However, there are multiple services that support NFT flashloan, e.g., NFTuloan . Since the voting power is counted as the proposal creation time,...

The users could duplicate their voting weight

Lines of code Vulnerability details Impact Any user who has an NFT could duplicate their voting weight at any time Proof of Concept 1- Alice has one NFT 2- He invokes delegate and passes to to his address 3- on delegate both of from == to are Alice addresses 4- on moveDelegateVotes from is the...

Elrond go 输入验证错误漏洞

Elrond go is an open source go implementation of the Elrond Network protocol by Elrond Network. An input validation error vulnerability exists in Elrond go versions prior to 1.3.34, which stems from a missing function name in MultiESDTNFTTransfer...

PT-2022-6254 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux Kernel version 6.0-rc2 Description: The issue is related to the use of memory after it has been freed, specifically within the nft osf eval function. This can allow an attacker to disclose sensitive information on affected installations...

PT-2022-23149 · Elrond · Elrond-Go

Name of the Vulnerable Software and Affected Versions: elrond-go versions prior to 1.3.34 Description: The issue affects elrond-go, the go implementation for the Elrond Network protocol. In affected versions, processing blocks that contain a MultiESDTNFTTransfer transaction with a missing functio...

CVE-2022-1016

A flaw was found in the Linux kernel in net/netfilter/nftablescore.c:nftdochain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker...

Nouns NFT owner delegating voting power to the zero-address will lock all owned Nouns forever

Lines of code Vulnerability details Impact Nouns NFTs represent governance voting power by having the NounsToken contract inherit the ERC721Checkpointable contract. The ERC721Checkpointable contract is based on the Comp.sol implementation by Compound. One of the modifications is not needing to...

User should not be able to use more votes that he has at the moment of voting

Lines of code Vulnerability details Impact In castVoteInternal function user can vote. And the votes that he has is calculated using the checkpoint when the proposal was created. This is not correct for few reasons. 1.Suppose in time t1 the proposal was created and in that time user1 had 2 tokens...