Upgraded Q -> M from #404 [1674736828553]

Judge has assessed an item in Issue 404 as M risk. The relevant finding follows: L‑06 Owner can renounce while system is paused The contract owner or single user with a role is not prevented from renouncing the role/ownership while the contract is paused, which would cause any user assets stored ...

lastSetMintExchangeRate is not updated

Lines of code Vulnerability details Impact The lastSetMintExchangeRate variable is not updated if exchange rate deviates the max amount. This becomes a problem since once Admin unpauses the system and new Exchange rate are being set, lastSetMintExchangeRate still points to exchange rate from last...

CVE-2022-46401

The Microchip RN4870 module firmware 1.43 and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112 accepts PauseEncReqPlainText before pairing is complete...

LP's ERC20 tokens cannot be rescued when owner closes the pair

Lines of code Vulnerability details Impact LP cannot be rescued when owner closes the pair. Aside from the NFT which can be salvaged through Pair.withdraw, the ERC20 token amounts cannot be rescued, resulting in fund loss. Proof of Concept In case of any malicious attempt to grief the protocol, t...

CVE-2022-46401

The Microchip RN4870 module firmware 1.43 and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112 accepts PauseEncReqPlainText before pairing is complete...

The pledge creators can't withdraw unused funds after the pledge is expired in the pause mode.

Lines of code Vulnerability details Impact Currently, the pledge creators can't do anything after the protocol is paused. So they can't withdraw their unused funds after the pledge is expired in the pause mode and the funds will be locked in the contract. Proof of Concept As we can see from...

Owner can set lockUntil to a very large timestamp to create not-removeable tier and not-pause-able tier

Lines of code Vulnerability details Impact Owner can set lockUntil to a very large timestamp to create not-removeable tier. when a tier is created, the owner can set lockUntil parameter @member lockedUntil The time up to which this tier cannot be removed or paused. when the owner call adjustTier,...

PT-2022-20888 · Concourse · Concourse

Name of the Vulnerable Software and Affected Versions: Concourse versions 6.x.y prior to 6.7.9 Concourse versions 7.x.y prior to 7.8.3 Description: The issue is an authorization bypass that allows a Concourse user to send a request with a body including :team name=team2 to bypass team scope check...

Bids can be created while paused

Lines of code Vulnerability details createBid allows for bid creation while the Auction is paused. As the latter happens on a system error mint failure, this can allow an attacker to interacts with the malfunctioning system. This at least can lead to misallocation of user's funds, i.e. freezing t...

CVE-2022-34102

Insufficient access control vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can pause the uninstallation of an executable to gain a SYSTEM level command prompt...

WordPress plugin WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Storage variable modifications when the contract is paused

Lines of code Vulnerability details Impact The function addMember can be called to modify the the storage variable community even if the contract is paused. function addMemberbytes calldata data, bytes calldata signature external virtual override // Compute hash from bytes bytes32 hash =...

Design/Logic Flaw

Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value...

CVE-2022-31111 Discrepency in transfer value and actual value due to incorrect truncation in Frontier

Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value...

CVE-2022-31111 Discrepency in transfer value and actual value due to incorrect truncation in Frontier

Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between EVM balance type and Substrate balance type was incorrectly implemented. This leads to possible discrepancy between appeared EVM transfer value and actual Substrate value...

User Could Change The State Of The System While In Pause Mode

Lines of code Vulnerability details Proof-of-Concept Calling NibblVault.updateTWAP function will change the state of the system. It will cause the TWAP to be updated and buyout to be rejected in certain condition. When the system is in Pause mode, the system state should be frozen. However, it wa...

sell() and buy() should not have whenNotPaused modifier

Lines of code Vulnerability details Impact Impacts are two fold: 1. admin should not be allowed to stop users from selling/cashing out their assets under any circumstance. 2. Due to poor timing or malicious admin activity, it could be the case that buy is put on pause right after initiateBuyout i...

whenNotPaused modifier missing

Lines of code Vulnerability details Impact whenNotPaused modifier is missing in both createBasket function NibblVaultFactory.solL80 and withdrawUnsettledBids function NibblVault.solL424 This means even when contract is in paused state this function will still be operational Note Other impacted...

Emergency withdrawals are broken

Lines of code Vulnerability details Impact Usually, in emergency situations, contracts will be paused by the owner to prevent further damage. To withdraw all funds, the MyStrategy.prepareWithdrawAll function has to be manually called right before BaseStrategy.withdrawToVault can be called see...

All withdrawal functionality is paused when contract is paused

Lines of code Vulnerability details Impact When the strategy contract is paused, all withdrawal functionality will be paused. Based on the comments in MyStrategy.sol and baseStrategy.sol, withdrawToVault should not be affected by the pause functionality. This is not the case due to the...