makeProposal can be front run with an arbitrary proposal modifications, enabling griefing attack

Handle hyh Vulnerability details Impact Griefing attack is possible for makeProposal as proposal details can be modified by anyone. Proposal setters have no access controls, requiring only that proposal be not current, so when makeProposal is executed after the preparation phase an attacker can...

Burning a User's Tokens for a Flash Proposal will not Deduct Their Balance

Handle kirk-baird Vulnerability details Impact The proposal to burn a user's tokens for a flash governance proposal does not result in the user losing any funds and may in fact unlock their funds sooner. Proof of Concept The function burnFlashGovernanceAsset will simply overwrite the user's state...

Bypass Vote Flipping Time Addition

Handle kirk-baird Vulnerability details Impact It is possible to bypass the additional 2hrs added to the length of voting when the vote flips from positive to negative or vice versa. This can be done by breaking the vote into two steps first sending enough fate to make the proposal zero. Then...

Realm Shim 安全漏洞

Realm Shim is the shim implementation of this folder containing the Realm API Proposal. A security vulnerability exists in Realm Shim that allows attackers to sandbox bypass via prototype contamination attack vectors...

Ruby on Rails: XSS vulnerabilities due to missing checks in tag helpers

XSS vulnerabilities were discovered in certain tag helpers in Rails, specifically in the FormTagHelper and TagHelper modules. These vulnerabilities allowed attackers to execute arbitrary JavaScript code by manipulating user-controlled input in tag attributes and tag names. The impact of these...

Council veto protection does not work

Handle TomFrenchBlockchain Vulnerability details Impact Council can veto proposals to remove them to remain in power. Proof of Concept The Vader governance contract has the concept of a "council" which can unilaterally accept or reject a proposal. To prevent a malicious council preventing itself...

Governance veto can be bypassed

Handle gzeon Vulnerability details Impact Since veto ensure none of the actions in proposal being vetoed point to the contract GovernorAlpha.sol:L562, a malicious proposal can be designed to have an action that point to governance and therefore effectively cannot be vetoed. Proof of Concept For a...

Stop ramp target price would create huge arbitrage space.

Handle jonah1005 Vulnerability details Stop ramp target price would create huge arbitrage space. Impact stopRampTargetPrice would set the tokenPrecisionMultipliers to originalPrecisionMultipliers0.mulcurrentTargetPrice.divWEIUNIT; Once the tokenPrecisionMultipliers is changed, the price in the AM...

Fastify: 1-click DOS in fastify-static via directly passing user's input to new URL() of NodeJS without try/catch

Summary: When fastify-static is mounted at root and registered the option redirect: true default of redirect option is false, the following line directly feed user's input which is req.raw.url to URL API without try/catch: https://github.com/fastify/fastify-static/blob/master/index.jsL439. A remo...

GHSA-4873-36H9-WV49 Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

Impact There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses externrefs, the host creates non-null externrefs, Wasmtime performs a garbage collection GC, and there has to ...

Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in Wasmtime

Impact There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger this bug, Wasmtime needs to be running Wasm that uses externrefs, the host creates non-null externrefs, Wasmtime performs a garbage collection GC, and there has to ...

GHSA-V4CP-H94R-M7XF Use after free passing `externref`s to Wasm in Wasmtime

Impact There was a use-after-free bug when passing externrefs from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple externrefs from the host to a Wasm instance at the same time, either by passing multiple externrefs as arguments from host code to a Wasm...

Use after free passing `externref`s to Wasm in Wasmtime

Impact There was a use-after-free bug when passing externrefs from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple externrefs from the host to a Wasm instance at the same time, either by passing multiple externrefs as arguments from host code to a Wasm...

CVE-2021-39218

Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.26.0 and before version 0.30.0 is affected by a memory unsoundness vulnerability. There was an invalid free and out-of-bounds read and write bug when running Wasm that uses externrefs in Wasmtime. To trigger thi...

YAxisVotePower.balanceOf can be manipulated

Handle cmichel Vulnerability details The YAxisVotePower.balanceOf contract uses the Uniswap pool reserves to compute a lpStakingYax reward: uint256 yaxReserves,, = yaxisEthUniswapV2Pair.getReserves; int256 lpStakingYax = yaxReserves .mulstakeAmount .divsupply .addrewardsYaxisEth.earnedvoter; The...

What Apple Can Do Next to Fight Child Sexual Abuse

The fallout from the company's recent proposal has created a new opportunity to fix how it roots out abusive material across its devices...

Possible to deny proposal creations

Handle cmichel Vulnerability details There can only ever be one active proposal. An attacker could front-run a proposal creation by submitting a dummy proposal. The original proposal creation would fail. Impact The cost of the attack is the proposal fees. There can be an incentive to deny the...

You can vote for proposal already completed

Handle s1m0 Vulnerability details Impact The mapPIDfinalised is set on completeProposal but voteProposal doesn't check it. A malicious user with enough capital and/or together with other people could execute a proposal in his favor e.g. a grant infinitely. Proof of Concept 1 newGrantProposal 2...

A proposal can be cancelled by anyone

Handle s1m0 Vulnerability details Impact A proposal can be cancelled by anyone if only exist another proposal with the same type and hasMinority has 16% votes. Proof of Concept 1 voteProposal assume this vote trigger finalise. finalise set mapPIDfinalisingproposalID = true 2 cancelProposal This...

Overview of the EU’s draft NIS 2 Directive

Anticipating stronger security requirements for critical EU sectors A pdf copy of this brief is available here. The EU Commission recently proposed a revision to its Directive on Security of Network and Information Systems NIS. The existing NIS Directive “NIS 1” requires EU Member States to enact...