Malicious code in payable-salmon-piranha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7536737b1f08db227ce6ea8fab6eedc8ca99ab4f17b0ec66f0d9a051ea550e8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-52803

Malicious code in payable-blue-nightingale npm...

EUVD-2025-52801

Malicious code in payable-salmon-piranha npm...

EUVD-2025-52802

Malicious code in payable-plum-marmoset npm...

MAL-2025-69849 Malicious code in payable-turquoise-deer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49817fd42aa1b0250b1f67928d31cf5c034d49f4caf133b1bac6e5b05217ee7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2020-9682

Malware in sbrugna...

Malicious code in payable-js-ipg-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4236d1ddc2eb9ca710a495ee98481d2a581fee6451b8e496835e93c54f92c1a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in payable-js-ipg-sdk-suba (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d702ab64f07220d7376645a0d0ad2d86688a3162960e49bd09ae493b567f43ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1207 Malicious code in payable-js-ipg-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4236d1ddc2eb9ca710a495ee98481d2a581fee6451b8e496835e93c54f92c1a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PartyGovernance contract cannot accept Eth

Lines of code Vulnerability details Impact The PartyGovernance contract does not have payable in it fallback back function which is the main context of allowing a contract to accept Ether or else it will revert or lost forever if receive. Proof of Concept Lack of payable fallback function is...

ExecutorPlugin missing payable when execute the transaction

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept executeTransaction in ExecutorPlugin is meant to execute transaction but in executeTxnAsModule function executeTxnAsModuleaddress account, Types.Executable memory executable internal...

ConsoleFallbackHandler.sol#simulate transaction cannot simulate transaction properly

Lines of code Vulnerability details Impact ConsoleFallbackHandler.sol does not use static call or delegate call Proof of Concept In the function / @dev Performs a delegetecall on a targetContract in the context of self. Internally reverts execution to avoid side effects making it static. Catches...

Missing payable modifier in ExecutorPlugin.executeTransaction(): Restricts Use of Native Assets (ETH) with Transactions

Lines of code Vulnerability details Impact A registered executor for a submodule cannot send ETH native assets with a transaction because the payable modifier is missing in the executeTransaction function. It's essential to address this issue to ensure full compatibility and functionality for...

Rewards cannot be transferred when calling protocol command

Lines of code Vulnerability details Summary Rewards are set up using protocol commands, but it's entrypoint is not payable. Impact Rewards can be set up by protocol authorities using the functions setConcRewards and setAmbRewards present in the LiquidityMiningPath contracts. These two are part of...

if lzReceiveNonBlocking failed to execute , they don't send back ,accumulated msg.value . malicious user drain that

Lines of code Vulnerability details Impact PerformFallBack is gonna fail and msg.value will be accumulated in that BranchBridgeAgent and malicious user can take over them Proof of Concept User deposited and When it's not executed ,user want to retrieve and callRetrieveSettlement ,send message to...

The current axelar router's implementation can't interact with any calls that requires native tokens

Lines of code Vulnerability details Impact Medium... this completely blocks off users that would need to call a contract and want to pass value to them, as they can't do this since the functions are not payable Proof of Concept See summary Additionally take a look at the Axelar's Router.sol and s...

User funds can be lost

Lines of code Vulnerability details Impact User funds sent by users can be lost forever Proof of Concept The contract LendingLedger.sol implements the function receive external payable to allow to the protocol to deposit the Canto used in the expected behaviour. But since the receive external...

LendingLedger Lack of method to rescue accidentally sent Canto

Lines of code Vulnerability details Impact There is no function to rescue Canto accidentally sent to LendingLedger so if governance fat-finger those Canto could be lost forever. Proof of Concept There is no function to transfer native token out of LendingLedger Tools Used Manual inspection...

Default Account fallback lack payable

Lines of code Vulnerability details Impact fallback lack payable,will lead to differences from the mainnet, and many existing protocols may not work Proof of Concept DefaultAccount Defined as follows: DefaultAccount The implementation of the default account abstraction. This is the code that is...

Honest users could lose funds due to the current implementation of executeProposal()

Lines of code Vulnerability details Impact In the InterChainGovernance.sol contract, the executeProposal function lacks an explicit check to ensure that the msg.value provided with the function call is greater than or equal to the nativeValue specified. After an extensive discussion with the...