7598 matches found
Pool: The EMERGENCY state cannot be recovered
Lines of code Vulnerability details Impact The owner can call Pool.adminAction to set the Pool contract state to EMERGENCY, and in the EMERGENCY state, no liquidity can be added or transferred, and no swaps can be made. However, the Pool contract does not have a function to recover the EMERGENCY...
Router.exactInputInternal doesn't check that swapped amount is same as amountIn provided by user
Lines of code Vulnerability details Impact Router.exactInputInternal doesn't check that swapped amount is same as amountIn provided by user. In case if it's not, then exact function doesn't do what it should. It doesn't trade exact amount of tokens. Proof of Concept If user calls...
PT-2022-36343
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.154 Description The issue is related to an integer overflow in the ghes estatus pool init function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...
Anyone can call addLiquidity function and be the router
Lines of code Vulnerability details Impact Anyone can call addLiquidity, meaning that when IAddLiquidityCallbackmsg.sender.addLiquidityCallbacktokenAAmount, tokenBAmount, data; is called, the msg.sender can be a contract that a malicious user has deployed and has a addLiquidityCallbacktokenAAmoun...
PT-2022-36226 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.78 Description: The issue is related to an integer overflow in the ghes estatus pool init function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...
Actor can send an arbitrary token when adding liquidity
Lines of code Vulnerability details Impact Anyone can call addLiquidity directly and can input tokenId, params and data. The data inputs are never checked, so the user can send anything in there. Since the erc20 tokens routed are defined in the data parameter, user could send any token. Since the...
Upgraded Q -> M from #38 [1670234424045]
Judge has assessed an item in Issue 38 as M risk. The relevant finding follows: L2. Pool selection for the compound is not restricted Compound function of AutoPxGmx contract is public and available for everyone. An attacker can create a custom pool with a higher fee value currently, on tests it...
CVE-2021-32915
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43866
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43873
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43864
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43870
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43865
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43872
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43869
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43869
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43870
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...
CVE-2021-43874
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...