CVE-2022-39384

OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external cal...

Xxe

OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external cal...

OpenZeppelin 安全漏洞

OpenZeppelin is a software application. A standard for secure blockchain applications. A security vulnerability exists in OpenZeppelin Contracts versions 3.2.0 and later through 4.4.1 and earlier, which stems from an exception set to support multiple inheritance that breaks the expectation of a...

CVE-2022-39384

OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external cal...

CVE-2022-39384 OpenZeppelin Contracts initializer reentrancy may lead to double initialization

OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external cal...

CVE-2022-39384 OpenZeppelin Contracts initializer reentrancy may lead to double initialization

OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external cal...

CVE-2022-39384: Improper Initialization

OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external cal...

CVE-2022-39384 OpenZeppelin Contracts initializer reentrancy may lead to double initialization

OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separate from contract creation the most prominent example being minimal proxies may be reentered if they make an untrusted non-view external cal...

CVE-2022-39384

OpenZeppelin Contracts (3.2.0–4.4.1) contain an initializer reentrancy issue caused by an exception used to support multiple inheritance, allowing reentry when an untrusted non-view external call is made during initialization. The impact is described as minor since upgradeable proxies are usually...

Missing support of non-standart ERC20

Lines of code Vulnerability details Vulnerability details Description In functions of PA1D and HolographOperator contracts there is logic relying on the fact that tokens implemented ERC20 standard especially, that transfer and transferFrom functions of the tokens returns bool result. But in...

_payoutToken[s]() is not compatible with tokens with missing return value

Lines of code Vulnerability details Impact Payout is blocked and tokens are stuck in contract. Proof of Concept PA1D.payoutToken and PA1D.payoutTokens call ERC20.transfer in a require-statement to send tokens to a list of payout recipients. Some tokens do not return a bool e.g. USDT, BNB, OMG on...

PA1D._payoutTokens() won't work for USDT and other inconsistent ERC20 tokens.

Lines of code Vulnerability details Impact Some ERC20 tokens USDT, BNB, OMG do not return a boolean on succesful transfer. Checking the returned value of transfer for these tokens will always fail. Proof of Concept Usage of ERC20 interface and require statement in PA1D.sol. Recommended Mitigation...

Royalties cannot be collected for many ERC20 tokens (USDT, BNB and many more) due to use of transfer function.

Lines of code Vulnerability details Description ERC20 royalties are paid using payoutTokens and payoutToken functions in PA1D.sol. Unfortunately these functions use ERC20's transfer instead of implementing safeTransfer: for uint256 i = 0; i length; i++ sending = bpsi balance / 10000;...

Unsafe downcast operations can lead to silent failures

Lines of code Vulnerability details Solidity won't perform automatic checks when downcasting and it's possible for some fields to overflow while adding tiers. Proof of Concept Assume that in JBTiered721DelegateStore.recordAddTiers, one item for tiersToAdd contains votingUnits bigger than the size...

Upgraded Q -> M from 42 [1666367610163]

Judge has assessed an item in Issue 42 as Medium risk. The relevant finding follows: Permit signature replay across forks Details: GolomTrader.sol defines chainId at contract deployment without reconstructing it for every signature. However, as stated in the security considerations section of...

Upgraded Q -> M from 964 [1666360503408]

Judge has assessed an item in Issue 964 as Medium risk. The relevant finding follows: Non-critical: EIP712 signatures on GolomTrader could be replayed in case of blockchain forks The chainId is burnt into EIP712DOMAINTYPEHASH rather than checked each time. This means that signatures could be...

Upgraded Q -> M from 221 [1665738683985]

Judge has assessed an item in Issue 221 as Medium risk. The relevant finding follows: L‑01 Don't use payable.transfer/payable.send The use of payable.transfer is heavily frowned upon because it can lead to the locking of funds. The transfer call requires that the recipient is either an EOA accoun...

[NAZ-M3] Use safeTransfer()/safeTransferFrom() instead of transfer()/transferFrom()

Lines of code Vulnerability details Impact It is a good idea to add a require statement that checks the return value of ERC20 token transfers or to use something like OpenZeppelin’s safeTransfer/safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so wil...

Use OpenZeppelin's safeTransferFrom instead of transferFrom when transferring ERC20 tokens

Lines of code Vulnerability details Impact In this case, since GRT token is used, the current implementation of GRT does have a return value for transferFrom and reverts on failure, but the same cannot be said for many other ERC20 tokens in the wild. OpenZeppelin recommends to always use...

Signature malleability not protected against

Lines of code Vulnerability details Vulnerability details OpenZeppelin has a vulnerability in versions lower than 4.7.3, which can be exploited by an attacker. The project uses a vulnerable version ECDSA signature malleability package.jsonL27-L28 package.jsonL27-L28 : "@openzeppelin/contracts":...