CVE-2021-48006 PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity

PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator entries from ops.txt. The removeOp function lowercases the supplied name but only removes an exactly matching entry, so an operator name stored with non-lowercase letters cannot be revoked using the deop...

Upgraded Q -> M from 234 [1659038052827]

Judge has assessed an item in Issue 234 as Medium risk. The relevant finding follows: 1. Update asset weight when calling VeTokenMinter.removeOperator When removing operator, there is no check to make sure that veAssetWeightsoperator has been removed. If governance forgot to call...

MixinOperatorResolver.sol#isResolverCached() become malfunctioning when an operator is removed

Handle WatchPug Vulnerability details When an operator is removed and rebuildCache is called, isResolverCached should return true. It returns false in the current implemenbtation. /// @notice Check the state of addressCache function isResolverCached external view returns bool bytes32 memory...