getRandomTokenIdFromFund not really random

Handle gpersoon Vulnerability details Impact The function getRandomTokenIdFromFund of NFTXVaultUpgradeable.sol is not really random, as noted in the name of the function getPseudoRand. The value of the blockhashblock.number - 1 is fully determined for al the transactions in the same block. The...

NFT can be minted for free after sale ended

Handle s1m0 Vulnerability details Impact The getPrice return 0 after the sale ended and SALELIMIT - numSales nft can be minted for free. Proof of Concept Tools Used Manual analysis Recommended Mitigation Steps Without documentation i'm not sure if it's the expected behaviour or not. If it's not y...

Potential reentrancy in safeTransferFrom functions

Handle 0xRajeev Vulnerability details Impact Reentrancy possible from onERC721Received implementation of a malicious contract at to address. But it doesn’t look like this cannot be exploited here because there are no state effects after the external interaction i.e. CEI pattern holds. Consider...

Missing zero/threshold check for NFT sale price

Handle 0xRajeev Vulnerability details Impact A zero or some minimum threshold check is missing for price parameter of startSale function which sets the mint price for NFTs. If accidentally set to 0 then all sales happen at this incorrect price leading to missed revenue. This cannot be corrected...

ERC-721 Enumerable Spec mismatch for return value of tokenByIndex() function

Handle 0xRajeev Vulnerability details Impact tokenByIndex is required to return the token at queried index but the implementation here returns the parameter index itself. This will prevent all querying of tokens. See reference implementation This will impact compatibility with NFT platforms that...

ERC-721 Enumerable Spec mismatch for index of tokenByIndex() function

Handle 0xRajeev Vulnerability details Impact Index starts at 0 for token array but the implementation here requires index to be greater than 0. This will prevent querying of token at index 0. See reference implementation This will impact compatibility with NFT platforms that expect full conformit...

Missing zero-address check for the beneficiary address

Handle 0xRajeev Vulnerability details Impact The beneficiary address specified in constructor receives all the proceeds from NFT sales which could be of significant value. However, there is no zero-address validation of this beneficiary address parameter during initialization in the constructor...

function tokenByIndex treats last index as invalid

Handle paulius.eth Vulnerability details Impact NFT indexes start from 0: // Don't allow a zero index, start counting at 1 return value.add1; so if there are 30 tokens, indexes would be 1-30. However, function tokenByIndex sets such boundaries: requireindex 0 && index TOKENLIMIT; which means that...

Missing zero/threshold check for NFT sale duration

Handle 0xRajeev Vulnerability details Impact A zero or some minimum threshold check is missing for saleDuration parameter of startSale function which sets the duration of the public sale of NFTs. If accidentally set to 0 then sales happen at zero price according to the logic in getPrice leading t...

PT-2021-8023 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.12.0-rc4-syzkaller Description: The vulnerability is related to a divide error in the nft limit init function, which is caused by the div u64 function dividing a 64-bit unsigned integer by a 32-bit unsigned...

A week in security (March 15 – 21)

Last week on Malwarebytes Labs, our podcast featured Adam Kujawa, who talked us through our 2021 State of Malware report. We cover our own research on: Royal mail parcel scam How your iPhone can tell you if you’re being stalked Careers in cybersecurity ProxyLogon PoC whack-a-mole Teen behind 2020...

This Week in Security News - March 19, 2021

Joker’s Latest Ploy and NFT Digital Art Is Already Attracting Hackers...

UBUNTU-CVE-2015-1573

The nftflushtable function in net/netfilter/nftablesapi.c in the Linux kernel before 3.18.5 mishandles the interaction between cross-chain jumps and ruleset flushes, which allows local users to cause a denial of service panic by leveraging the CAPNETADMIN capability...

Linux Kernel 'nft_flush_table' function local denial of service vulnerability

Linux is an open source computer operating system kernel. A local denial of service vulnerability exists in the Linux Kernel 'nftflushtable' function, which can be exploited by a local attacker with CAPNETADMIN to launch a denial of service attack...

Sercomm TCP/32674 Backdoor Reactivation

No description provided by source. / PoC to reactivate Sercomm TCP/32674 backdoor See http://www.synacktiv.com/ressources/TCP32764backdooragain.pdf Eloi Vanderbeken - Synacktiv THIS SOFTWARE IS PROVIDED BY SYNACKTIV ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, T...