Exploit for SQL Injection in Prestashop

LabelGrup Networks, official PrestaShop Partner !LabelGrup L...

GHSA-W9G2-3W7P-72G9 Incorrect success value returned in vyper

Background During the audit of Lido's Gate Seals code statemind team identified a weird behavior of the code that uses rawcall: https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vyL164 . Construction like this: vyper success = rawcall...

PYSEC-2023-131

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper compiler generates the wrong bytecode. Any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the...

Interpretation Conflict

@openzeppelin/contracts is vulnerable to Interpretation Conflict. The vulnerability exists because the TransparentUpgradeableProxy clashing selector calls may not be delegated if the clashing function has a different signature with incompatible ABI encoding, which could lead to proxy revert while...

PT-2023-22826 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.1 through 0.3.7 Description: The Vyper compiler generates the wrong bytecode in versions 0.3.1 through 0.3.7. Any contract that uses the raw call with revert on failure=False and max outsize=0 receives the wrong response fr...

Sound adjusting of a position could fail

Lines of code Vulnerability details Impact Increasing collateral and decreasing it's liquidation price, such that with new liquidation price and old collateral position is becoming unsound, leads to a revert. Such situation can happen often, imagine position that's fully minted and has market pri...

can launch a challenge without any collateral in MintingHub.sol

Lines of code Vulnerability details Impact launchChallenge... function in MintingHub.sol ignores return value by challenge.position.collateral.transferFrom Several tokens do not revert in case of failure and return false. If the token used as collateral return false, the user can launch a challen...

Position created with BNB as collateral will result in locked collateral

Lines of code Vulnerability details withdrawCollateral allows position owners to withdraw collateral from the position - as long as it is still collateralized afterwards. File: Position.sol 263: function withdrawCollateraladdress target, uint256 amount public onlyOwner noChallenge noCooldown 264:...

Let Me Suggest For You

Lines of code Vulnerability details Impact Scope of vulnerabiliy - This vulnerability allows any user including users the do not own any share tokens to effectivly cast a veto on a minter suggetion. The only requirement to excecute the vulnerability is to have the minimun fee in the acccount. In...

MuteBond is susceptible to DOS

Lines of code Vulnerability details Proof of Concept Observe that if timeToTokens is called with locktime = 1 week, amount 52, it will return 0. function timeToTokensuint256 amount, uint256 locktime internal pure returns uint256 uint256 weektime = 1 weeks; uint256 maxlock = 52 weeks;...

Incorrect parameter in withdraw function

Lines of code Vulnerability details Impact An incorrect parameter is used in the withdraw function in SfrxEth.sol. The amount variable is used when the frxEthBalance variable should be used to calculate minOut. The amount that gets swapped at the FRXETHCRVPOOLADDRESS is the frxEthBalance, not the...

poolPrice in Reth.sol can overflow and revert

Lines of code Vulnerability details Impact To determine the value of sqrtPriceX96 that will cause an overflow, we need to analyze the calculation in the function: sqrtPriceX96 uintsqrtPriceX96 1e18 96 2 The maximum value for a uint256 is 2^256 - 1. An overflow occurs when the result of the...

KangarooVault.removeCollateral updates storage without actually removing collateral, resulting in lost collateral

Lines of code Vulnerability details The admin can call KangarooVault.addCollateral to add additional collateral to a Power Perp position. File: src/KangarooVault.sol 424: function addCollateraluint256 additionalCollateral external requiresAuth nonReentrant 425: SUSD.safeApproveaddressEXCHANGE,...

Tray Owner Will Not be Able to Burn any Tray

Lines of code Vulnerability details Impact 1. There are two issues here, the check namespaceNFT != msg.sender && trayOwner != msg.sender && getApprovedid != msg.sender && !isApprovedForAlltrayOwner, msg.sender will only revert CallerNotAllowedToBurn if all of the conditions are true which is very...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.523.4.1 - mm: kvmalloc does not fallback to vmalloc for incompatible gfp flags Michal Hocko Orabug: 35164196 4.14.35-2047.523.4 - rds: ib: Keep IB MRs on cleanlist unless we are tearing down the pool Hakon Bugge Orabug: 34987235 - rds: ib: Add FRWR related statistics counters Hakon...

execute function should be payable

Lines of code Vulnerability details Impact execute will revert when msg.value 0 Proof of Concept Lacking payable mutability specifier. function execute bytes32 callId, Action calldata actions, uint256 allowFailureMap external override authEXECUTEPERMISSIONID returns bytes memory execResults,...

Upgraded Q -> 2 from #795 [1677634099280]

Judge has assessed an item in Issue 795 as 2 risk. The relevant finding follows: 04 VALUES OF fees ARE NOT CHECKED IN Vault.initialize FUNCTION When calling the following Vault.initialize function, the values of fees are not checked. It is possible that these fees are set to be above 1e18 when...

kernel: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"

In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsiunregisterconnectors" The recent commit 87d0e2f41b8c "usb: typec: ucsi: add a common function ucsiunregisterconnectors" introduced a regression that caused NULL dereference at...

LinearDistributor.declareReward can revert due to dependency of balance

Lines of code Vulnerability details Impact LinearDistributor.declareReward will revert and it can cause permanent DOS. Proof of Concept In LinearDistributor.declareReward, if the balance is greater than the bufferRequirement, the rest will be forfeited. if balance bufferRequirement // We have mor...

The latest malt price can be less than the actual price target and StabilizerNode.stabilize will revert

Lines of code Vulnerability details Impact StabilizerNode.stabilize will revert when latestSample priceTarget and msgSender is not an admin and not whitelisted, it asserts livePrice minThreshold. And minThreshold is calculated as follows: uint256 priceTarget = maltDataLab.getActualPriceTarget;...