Namespace fuse ignores font class attribute from tile data

Lines of code Vulnerability details Impact The fuse function present in the Namespace contract mints a new Namespace NFT based on the given character data that references Tray tiles owned by the caller. For each character, the implementation will use the characterToUnicodeBytes function from the...

A user can mint a PFP NFT multiple times using the same _nftId

Lines of code Vulnerability details Impact A user might unintentionally "intentionally" try to take advantage of the mint function in ProfilePicture.sol Proof of Concept The pfp mapping stores the pfp data per NFT, L31-32 of Profilepicture.sol /// @notice Stores the pfp data per NFT mappinguint25...

User can fuse an NFT with minimal cost

Lines of code Vulnerability details Impact User can fuse an NFT with minimal cost Proof of Concept The fuse is used to fuse a new Namespace NFT with the referenced tiles,if it is called, the protocol will transfer fusing costs from msg.sender to revenue address. The fusing costs is calculated...

Users can fuse an NFT without burning a tray NFT

Lines of code Vulnerability details Impact Users can fuse an NFT without burning a tray NFT Proof of Concept The Namespace protocol allows user to fuse a new Namespace NFT with the referenced tiles. Inside the fuse function, the protocol first transfer fusing costs from msg.sender to revenue...

Missing check for NFT contract, a bad actor can mint a PFP NFT without having a CID NFT

Lines of code Vulnerability details Impact Missing check for NFT contract, a bad actor can mint a PFP NFT without having a CID NFT. Proof of Concept The ProfilePicture.mint is used to mint a new PFP NFT. function mintaddress nftContract, uint256 nftID external uint256 tokenId = ++numMinted; if...

Reentrancy in ProfilePicture.mint()

Lines of code Vulnerability details Impact Reentrancy in ProfilePicture.mint Proof of Concept The protocol allows user to mint a PFP NFT. Inside the mint function ,there is a check that ERC721nftContract.ownerOfnftID != msg.sender, as the code below the nftContract and nftID is specified by the...

kernel: Netfilter integer overflow vulnerability in nft_payload_copy_vlan

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution...

Vulnerability Revealed OpenSea NFT Market Users’ Identities

By Waqas It was a cross-site search XS-Search vulnerability that could be exploited by an attacker to obtain a user's identity. This is a post from HackRead.com Read the original post: Vulnerability Revealed OpenSea NFT Market Users Identities...

Deanonymizing OpenSea NFT Owners via Cross-Site Search Vulnerability

TLDR Recently, a cross-site search vulnerability was discovered affecting the popular NFT marketplace OpenSea. When successfully exploited, this issue allows for the deanonymization of OpenSea users by linking an IP address, a browser session, or an email in certain conditions to a specific...

Malicious user can frontrun the selling or transferring of a ticket to claim the rewards

Lines of code Vulnerability details A bad actor can trick a user into buying an unclaimed ticket and frontrun the selling or transfer of the NFT to claim the rewards associated with the ticket before the original transaction. Impact Given the described scenario, a bad actor can frontrun the...

In nf_tables_updtable if nf_tables_table_enable returns an error nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del() but the transaction was never placed on a list -- the list head is all zeroes this results in a NULL pointer dereference.

...

CVE-2023-26488 OpenZeppelin Contracts contains Incorrect Calculation

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the...

Upgraded Q -> 3 from #460 [1677510923458]

Judge has assessed an item in Issue 460 as 3 risk. The relevant finding follows: Lines of code Vulnerability details Impact The safeTransferFrom function on the ClearingHouse is normally used when an OpenSea auction successfully ends and the required ERC20/WETH have been transferred to the...

SUSE CVE-2015-1573

The nftflushtable function in net/netfilter/nftablesapi.c in the Linux kernel before 3.18.5 mishandles the interaction between cross-chain jumps and ruleset flushes, which allows local users to cause a denial of service panic by leveraging the CAPNETADMIN capability...

SUSE CVE-2022-2078

A vulnerability was found in the Linux kernel's nftsetdescconcatparse function .This flaw allows an attacker to trigger a buffer overflow via nftsetdescconcatparse , causing a denial of service and possibly to run code...

SUSE CVE-2022-42432

This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel 6.0-rc2. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...

Adding NFTS with AssociationType ORDERED or PRIMARY may cause overwriting

Risk rating Medium Risk Links to affected code Impact Subprotocol NFTs may be trapped in contract CidNFT forever. Proof of Concept When adding NFT to CidNFT with AssociationType ORDERED or PRIMARY, the cidData is written directly, without checking and handling the case that a previously added nft...

nftAddress can be a malicious NFT

Lines of code Vulnerability details Impact In the subprotocolregistry contract, users are allowed to register any subprotocols. As long as the supportsinterface condition is met. The validity of the nftaddress address is not checked. function register bool ordered, bool primary, bool active,...

User can lose NFT if wrong type is given to add function

Lines of code Vulnerability details Impact If a user when trying to add its NFT to a given subprotocol provide a wrong association type by accident to the add function, the NFT will be transferred to the CidNFT contract but it will not be associated with any protocol type, because of that when th...

Other users cannot help a CIDNFT holder add subprotocols to the NFT

Lines of code Vulnerability details Impact Other users cannot approve and help CIDNFT holders add subprotocols to the NFT, breaking protocol specifications. Proof of Concept In the video walkthrough, around the 8 minute mark, it is mentioned that users can help NFT holders add subprotocols to the...