Lack of require in redeemToken could produce token loses

Lines of code Vulnerability details Impact Lack of require in redeemToken could produce token loses. Proof of Concept In the method redeemToken the user set the expected redeemAmount, it will compute the expected shares to burn, and after it, it will transfer the amout according the redeemAmount...

Chainlink oracle might return stale data

Lines of code Vulnerability details Impact Oracle might return stale data for basePrice and quotePrice. Proof of Concept refreshedAssetPerBaseInUQ in ChainlinkPriceOracle.sol does not check if the data from Chainlink is fresh . If there is a problem with the Chainlink oracle, this contract may be...

All the scxMinted is at risk of being burnt.(Limbo.sol)

Handle Hawkeye Vulnerability details Impact If one of the variables that calculate adjustedRectangle is a zero value,it will impair the calculation of excessSCX which would equal to all of the scxMinted on line 219.Nothing will be deducted from scxMinted on line 229 since adjustedRectangle =0...

Unchecked return value for token.transfer call

Handle WatchPug Vulnerability details It is usually good to add a require-statement that checks the return value or to use something like safeTransfer; unless one is sure the given token reverts in case of a failure. Instances include: token.transfermsg.sender, amount; token.transfermsg.sender,...

Unchecked return value for token.transferFrom call

Handle WatchPug Vulnerability details It is usually good to add a require-statement that checks the return value or to use something like safeTransferFrom; unless one is sure the given token reverts in case of a failure. /// ... /// @param token Token that will be issued through this launch event...

Use safeTransferFrom consistently instead of transferFrom

Handle Jujic Vulnerability details Impact It is good to add a require statement that checks the return value of token transfers, or to use something like OpenZeppelin’s safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so will cause silent failures of...

setLockPeriods accepts multipliers less than 100 (1x mult)

Handle StErMi Vulnerability details Impact In the setLockPeriods you are not making any checks on the multipliers value for a given index. It means that the multiplier could be less than 100 1x. Proof of Concept Tools Used Manual Recommended Mitigation Steps If you don't want to enable multiplier...

Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

Handle defsec Vulnerability details Impact It is good to add a require statement that checks the return value of token transfers or to use something like OpenZeppelin’s safeTransfer/safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so will cause silen...

Unchecked return value for token.transfer call

Handle WatchPug Vulnerability details It is usually good to add a require-statement that checks the return value or to use something like safeTransfer; unless one is sure the given token reverts in case of a failure. Instances include: IERC20Upgradeablevault.transferto, minTokenIn-amountToken;...

No checks in setAddresses() functions

Handle jayjonah8 Vulnerability details Impact Since the setAddresses functions can only be called once during deployment and passes in many addresses which are set in storage, its important to have safety checks ensuring that there are no duplicate addresses which can easily happen while passing...

[SECURITY] Fedora 34 Update: php-symfony4-4.4.35-1.fc34

Symfony PHP framework version 4. NOTE: Does not require PHPUnit bridge...

Possible deny of service by human error

Handle 0x1f8b Vulnerability details Impact Possible Deny of service. Proof of Concept The method removeFromTokenWhitelist of the contract ProtocolGovernance doesn't check if the argument addr it's inside the tokensAllowed map before remove it, the problem is if the user call twice this method it'...

Missing Emergency Pause Check

Handle defsec Vulnerability details Impact During the manual code review, It has been observed that minting progress is not checked when the contract is emergency paused. This can cause misfunctionality and unlocking user funds during the emergency pausing. Proof of Concept 1- Navigate to ""...

Excessive require makes the transaction fail unexpectedly

Handle WatchPug Vulnerability details The check for RENCRVVAULT.blockLock is only needed when if amounts1 0 || amounts2 0. However, in the current implementation, the check is done at the very first, making transactions unrelated to RENCRVVAULT fail unexpectedly if there is a prior transaction...

Ethereum wibBTC price per share dependant on being updated every X time, but contract has no checks whether price is updated

Handle loop Vulnerability details The price of pricePerShare in WrappedIbbtcEth.sol is dependant on two things: The pricePerShare of core. updatePricePerShare being invoked every X time to update the pricePerShare of wibBTC. The only time updatePricePerShare is invoked inside the contract is duri...

Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013)

On October 4, 2021, Apache HTTP Server Project released Security advisory on a Path traversal and File disclosure vulnerability in Apache HTTP Server 2.4.49 and 2.4.50 tracked as CVE-2021-41773 and CVE-2021-42013. In the advisory, Apache also highlighted “the issue is known to be exploited in the...

fillZrxQuote doesn't return correct values when zrxSellTokenAddress == zrxBuyTokenAddress

Handle harleythedog Vulnerability details Impact Suppose that swapByQuote is called with zrxSellTokenAddress == zrxBuyTokenAddress, and neither of these addresses "signifiesETHOrZero". The contract first transfers amountToSell of these tokens from the sender's account into the contract and update...

Setting Factory.bondPercentDiv to zero cause Denial of Service in Auction.bondForRebalance()

Handle pants Vulnerability details The function Factory.setBondPercentDiv allows the owner to set the state variable Factory.bondPercentDiv to zero. Impact If Factory.bondPercentDiv equals zero then the function Auction.bondForRebalance will always revert due to a division by zero: bondAmount =...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 Path traversal and file disclosure vulnerabilit...

Two Way Chat < 3.1.5 - Admin+ Local File Inclusion

The plugin does not properly sanitise and validate user input before using in require statements, leading to Local File Inclusion issues PoC https://example.com/wp-admin/admin.php?page=TWCHsettings=../../index https://example.com/wp-admin/admin.php?page=TWCHsettings=Float=../../index...