WordPress plugin Loan Repayment Calculator and Application Form Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Interest still accuring when repayment is paused, creating debt that cannot be repaid

Lines of code Vulnerability details Impact Interest still accuring when repayment is paused Proof of Concept When the admin pause the lending pool repayment, as timestamp elapses, interest still accuring /// @inheritdoc ILendingPool function accrueInterest public uint lastAccruedTime =...

Only ensure the Lp is repaid when close the position invites MEV bot

Lines of code Vulnerability details Impact Only ensure the Lp is repaid when close the position invites MEV bot Proof of Concept in the function closePosition function closePosition DataStruct.ClosePositionParams calldata params, DataCache.ClosePositionCache memory cache, Lien.Info memory lien,...

WordPress Loan Repayment Calculator and Application Form Plugin <= 2.9.3 is vulnerable to Cross Site Scripting (XSS)

Software Loan Repayment Calculator and Application Form Type Plugin Vulnerable versions = 2.9.3 Fixed in 2.9.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-50829 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5f5a8e271e7e Credits DoYeon...

interest is still accuring when the market is paused, force user to incur debts

Lines of code Vulnerability details Impact interest is still accuring when the market is paused, force user to incur debts Proof of Concept when the function accure is called the interest is accured after the interest rate is calculated uint256 interestRate = IIRMirm.getInterestRateaddressthis,...

MEV bot can frontrun user's repayment to liquidate user first when the OmniPool is unpaused

Lines of code Vulnerability details Impact MEV bot can frontrun user's repayment to liquidate user first when the OmniPool is unpaused Proof of Concept this report tries to combine a few issue 1. when OmniPool is paused, interest is still accuring 2. when OmniPool is paused, user cannot repay 3...

User can manipulate coinBalance to have better collateralization rate

Lines of code Vulnerability details Impact Users can manipulate coinBalance mapping in the SafeEngine by calling ODSafeManager::transferInternalCoins in order to improve their collateralization rate generate more and repay less debt. Proof of Concept When a user wants to be able to generate debt...

Anyone can call replenishReserves(...) (token version) to repay borrowed reserves with reserves

Lines of code Vulnerability details Impact The replenishReservestoken, ... can be called by anyone. Proof of Concept The NATSPEC comment in the IBranchPort states the replenishReservestoken, ... can only be called by the port strategy itself as shown below / @notice allow approved address to repa...

Flashloan excess debt is not sent to user

Lines of code Vulnerability details Impact These vulnerabilities can have the following impacts: 1. Liquidators may lose their eligible funds due to missing transfers of excess debt assets. 2. Excess debt TR tokens could remain in the contract after LP.flashloan claim back borrowed funds, which c...

cleanup() does not properly handle debt repayment

Lines of code Vulnerability details Impact The cleanup... function in the PositionManager.sol contract is used to deposit remaining users assets back to ROE, repaying debt if any. However the users debt will not be repaid if the user has debt leading to loss of funds for the lenders and the proje...

Wrong calculation of debt in function close0 may lead to loss of funds.

Lines of code Vulnerability details Impact In the function close, the debt was equated to the repayAmount after checking that repayAmountis greater than zero and less than the debt. Consider a situation where a user is owing 10 tokens and wants to repay 3 tokens. since 3 passes the check of being...

Loss of Funds when user wants to repay debt and underflow in _repay () function

Lines of code Vulnerability details Impact There is no check for if userBorrowPartto is greater than or equal to part before subtraction which can lead to loss of funds for user or underflow, incase a user inputs more amount than the user is in debt for. Proof of Concept Provide direct links to a...

BORROWERS CAN AVOID LIQUIDATIONS, IF ERC777 TOKEN IS CONFIGURED AS AN emissionToken

Lines of code Vulnerability details Impact If a borrower is undercollateralized then he can be liquidated by a liquidator by calling the MErc20.liquidateBorrow function. liquidateBorrow function calls the MToken.liquidateBorrowFresh in its execution process. Inside the liquidateBorrowFresh functi...

Users repay more than the approved amount.

Lines of code Vulnerability details Impact More tokens can be repaid than were approved leading to loss of funds Proof of Concept The repayBorrowFresh function does the following: 1. Checks if repay is allowed by calling comptroller.repayBorrowAllowed with the input repayAmount. 2. Fetches the...

Incorrect poolTotalEUSDCirculation Calculation

Lines of code Vulnerability details Impact poolTotalEUSDCirculation calculated incorerctly so it can effect reward distribution Proof of Concept The following line of code deduces repaid amount from poolTotalEUSDCirculation while the fee that is part of repaid amount will be distribute as rewards...

Attacker can use buyNftFromMarket() to buy an NFT from an arbitrary collection

Lines of code Vulnerability details Impact The function buyNftFromMarket allows a borrower to buy an NFT from the same collection to repay a loan. At the end of the function flow, it checks that the contract actually holds the NFT tokenId and assumes that it is the acquired NFT. However, this is...

Particle Exchange can be used to swap NFTs within the collection for free

Lines of code Vulnerability details Particle Exchange can be used to swap NFTs within the collection for free Impact In Particle, a borrower can take an NFT as a loan and close it using another NTF within the same collection. This is present in the different functions that can be used to repay a...

Challenges can be frontrun with de-leveraging to cause lossses for challengers

Lines of code Vulnerability details Impact Challenges, once created, cannot be closed. Thus once a challenge is created, the challenger has already transferred in a collateral amount and is thus open for losing their collateral to a bidding war which will most likely close below market price, sin...

end() reverts if bidder blacklisted by collateral token, grieving challenger

Lines of code Vulnerability details A successful challenge can be ended via MintingHub.end. This transfers challenge.size collateral back to the challenger, before repaying the challenge and paying the challenger the reward. In this call, position.notifyChallengeSucceeded is called. This transfer...

makePayment() may increase the user's debt

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept makePayment will be called when the user needs to repay the money, in two cases. 1. If the repayment amount = borrowed amount + interest, then the loan is paid off and the corresponding...