Project Owner can mint all tokens to their own address

Lines of code Vulnerability details Impact A project owner may mint all tokens for the project in JBController.mintTokensOf , with all tokens minted by the project owner to their own address, the payer during any pay call would be unable to to mint any project token as the mint function would...

Some fund could be locked in the project forever because only contributors but not project token holders can redeem

Lines of code Vulnerability details Some fund could be locked in the project forever because only contributors but not project token holders can redeem Impact Once the contributor transfered the project tokens to someone elsein some DEX maybe, these tokens could never be redeemed. One of the...

Discourse < 2.8.5 Information Disclosure Vulnerability

Discourse is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2022-31096

Discourse (open source discussion platform) has a vulnerability where a logged-in user can redeem an invite with an email that doesn’t match the invite or violates the invite’s email domain restriction, potentially leading to viewing content restricted to certain groups. The issue is worsened whe...

CVE-2022-31096 Invites restricted to an email or invite links restricted to an email domain may be bypassed by a under certain conditions in Discourse

Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. The impact of this flaw is aggravated when the invite h...

PT-2022-20524 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse affected versions not specified Description: The issue allows a logged-in user to redeem an invite with an email that either doesn't match the invite's email or does not adhere to the email domain restriction of an invite link. This...

ERC5095 redeem must check allowance with principalAmount instead of underlyingAmount

Lines of code Vulnerability details Impact ERC5095 redeem must check allowance with principalAmount instead of underlyingAmount. Allowing any user to redeem token of anybody freely. This is very critical, anyone can lost their money everytime without their acknowledgement. Proof of Concept functi...

Redeemer.sol#redeem() the principal token from Notional can not be redeemed

Lines of code Vulnerability details int256 amount = IERC20principal.balanceOflender; // Transfer the principal token from the lender contract to here Safe.transferFromIERC20principal, lender, addressthis, amount; if p == uint8MarketPlace.Principals.Swivel // Redeems zc tokens to the sender's...

Redeemer.sol#redeem() can be called by anyone before maturity, which may lead to loss of user funds

Lines of code Vulnerability details function redeem uint8 p, address u, uint256 m public returns bool // Get the principal token that is being redeemed by the user address principal = IMarketPlacemarketPlace.marketsu, m, p; // Make sure we have the correct principal if p !=...

Avoid using address(this).balance for internal accounting

Lines of code Vulnerability details Impact This could reduce or increase the amount of ETH that token-holders are able to redeem for a reserve token in the case of a buyout success. Proof of Concept Using addressthis.balance for any internal accounting for smart contract poses risks. Using...

No Slippage Protection During Redeeming Matured Positions

Lines of code Vulnerability details Proof-of-Concept The lack of slippage checks can cause redemption of matured positions to happen at a bad rate/prices, resulting the trade to receive fewer tokens than the fair market rate/price. The NotionalTradeModule.redeemMaturedPositions function calls the...

wfCash tokens can be locked in Set

Lines of code Vulnerability details Impact The automatic redemption of matured wfCash tokens within the NotionalTradeModule.moduleRedeemHook hook can cause wfCash tokens to be locked within the Set and prevent investors to redeem. The NotionalTradeModule.moduleRedeemHook hook is always called...

Rounding-error can be redeemed for free

Originally part of a QA report by gzeon 59 Rounding-error can be redeemed for free If the redeemAmount is 0 but less than the value of 1 share, 0 share will be burned while the user can withdraw non-zero amount. uint256 shares = tokenToSharesredeemAmount; --- The text was updated successfully, bu...

[WP-H1] A malicious early user/attacker can manipulate the vault's pricePerShare to take an unfair share of future users' deposits

Lines of code Vulnerability details This is a well-known attack vector for new contracts that utilize pricePerShare for accounting. / @notice Calculates the number of shares that should be minted or burnt when a user deposit or withdraw. @param tokens Amount of asset tokens @return Number of...

An attacker can make users' funds get "locked" in the contract (the owner can get them out and transfer them back to the users)

Lines of code Vulnerability details Impact If a user manages to be the first user to deposit into the contract, he will be minted shares and he can steal all the other users' deposits. Proof of Concept 1. The attacker deposits 1 token into the contract and 1 share is minted to him totalSupply and...

Market Expiration is Not Enforced Onchain

Lines of code Vulnerability details Impact The expiryTime variable is stored in the PrePOMarket.sol contract but not enforced anywhere in the contract. As a result, if a public offering never comes to fruition, then finalLongPrice will never be set and hence users will be expected to redeem...

Depositors are at mercy of admins to get their funds back

Handle cmichel Vulnerability details When depositors want their funds back and there are not enough funds in the vault or the strategy, the aUST in the BaseStrategy needs to be redeemed. This redemption process is asynchronous due to the nature of EthAnchor and requires an admin to redeem the aUS...

exitTempusAMMAndRedeem redeems to the wrong account

Handle cmichel Vulnerability details In TempusController.exitTempusAMMAndRedeem the first one, the inner exitTempusAMMGivenAmountsOut call redeems LP tokens and sends the yield&principal shares to the msg.sender already. It then tries to redeem the received shares for backing tokens or...

Unable to redeem rest funds if deposited reward is not multiplier of allocatedTokensPerEpoch

Handle xYrYuYx Vulnerability details Impact Owner will deposit any amount of reward if amount is greater than allocatedTokensPerEpoch. This means that it is possible that owner can sent amount which is not multiplier of allocatedTokensPerEpoch. For example, when allocatedTokensPerEpoch is 1 CQT,...

NFTs can never be redeemed back to their conviction scores leading to lock/loss of funds

Handle 0xRajeev Vulnerability details Impact Besides the conviction scores of users, there appears to be tracking of the FairSide protocol’s tokenized conviction score as a whole using fscAddress = addressfairSideConviction. This is evident in the attempted reduction of the protocol’s score when ...