Exploring the Vulnerabilities of Seaport: A Technical Analysis of a Fake Signature Attack on Non-Fungible Tokens

Lines of code Vulnerability details Impact This finding aims to provide a comprehensive analysis of the sc4m trend, which emerged in August 2022, and has since been a prevalent issue in the WEB3 space. Despite efforts to combat this phenomenon, bad actors continue to engage in illicit activities,...

Orders may not be fillable due to missing approvals

Lines of code Vulnerability details Not all IERC20 implementations revert when there's a failure in approve. If one of these tokens returns false, there is no check for whether this has happened during the order listing validation, so it will only be detected when the order is attempted. Impact I...

Animoca Brands’ Subsidiary TinyTap To Auction Second Set of Publisher NFTs

By Deeba Ahmed The auctioning will commence on 15 December on OpenSea at 19:00 EST. Publisher NFTs grant co-publishing rights to a TinyTap course. This is a post from HackRead.com Read the original post: Animoca Brands Subsidiary TinyTap To Auction Second Set of Publisher NFTs...

NFT Marketplace OpenSea Suffers Data Breach- Users’ Email IDs Leaked

By Deeba Ahmed In a blog post published Wednesday, OpenSea said the issue was caused by an employee of Customer.io, which is… This is a post from HackRead.com Read the original post: NFT Marketplace OpenSea Suffers Data Breach- Users Email IDs Leaked...

MAL-2022-5100 Malicious code in opensea-ships-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a3635ace2bf4429178054ef42ceb3653e6f2645d6c6d209d2fd0fdd305778e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5098 Malicious code in opensea-creatures (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4df2c72b313b14809cf8d7591f18360166872d65599afdb6391ae4be23a4d13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5099 Malicious code in opensea-erc1155 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57ed9708d2415ab3223ea55143304ce5afb9087aba7a655afdc96d9ad56c5102 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opensea-creatures (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4df2c72b313b14809cf8d7591f18360166872d65599afdb6391ae4be23a4d13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opensea-ships-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a3635ace2bf4429178054ef42ceb3653e6f2645d6c6d209d2fd0fdd305778e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opensea-erc1155 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57ed9708d2415ab3223ea55143304ce5afb9087aba7a655afdc96d9ad56c5102 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fulfill transactions that are not protected with a deadline may lead to unfavorable trade.

Lines of code Vulnerability details Impact A fulfill transaction of order with descending/ascending amount should be protected by the deadline. The price of an order with a descnding amount is sensitive to the time. Letting users make such a trade without providing the deadline would lead to...

Restricted Trades Vulnerable to Stolen Items Being Traded

Lines of code Vulnerability details Impact The current contract does not check for stolen items. Traditionally, Opensea has frozen items that are stolen based on its stolen item policy. It was possible to do so on Opensea at the UI level. However, with Seaport, anyone can list a restricted trade...

Frontrunning Private Trades Vulnerability

Lines of code Vulnerability details Impact The inability to create private trades in the Seaport contract would affect users significantly. Users will be forced to create public trades that run the risk of being frontrun. Proof of Concept Today, all trades are private meant for specific offerer a...

Compromised Channel Can Compromise ALL NFTs and Tokens

Lines of code Vulnerability details Impact The contest IN SCOPE section clearly states that offer items can only be transferred by a conduit that only has Seaport set as a channel. However, this condition is not true. If a compromised channel is added to a conduit, then ALL the NFTs and tokens th...

A week in security (May 2 – 8)

Last week on Malwarebytes Labs: Google, Apple, and Microsoft step hand in hand into a passwordless future OpenSea warns of Discord channel compromise Avoid these Instagram “Get rich with Bitcoin” scams Steer clear of fake premium mobile app unlockers How Instagram scammers talk users out of their...

OpenSea warns of Discord channel compromise

OpenSea, the primary marketplace for buyers and sellers of non-fungible tokens NFTs, has reported major problems with its Discord support channel. How major? Well, theres a "potential vulnerability" which allowed spambots to post phishing links to other users. A problem that lead OpenSea Support ...

WordPress plugin Opensea跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. The WordPress plugin Opensea 1.0.3 has a cross-site scripting vulnerability that stems from the plugin's...

CVE-2022-1228

The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-1228

The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-1228

The Opensea WordPress plugin before 1.0.3 does not sanitize and escape some of its settings, like its "Referer address" field, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...