Lucene search
+L

17 matches found

Code423n4
Code423n4
•added 2023/09/11 12:0 a.m.•166 views

Fee on transfer tokens will cause users to lose funds

Lines of code Vulnerability details Impact Some ERC20 tokens allow for charging a fee any time transfer or transferFrom is called. If a contract does not allow for amounts to change after transfers, subsequent transfer operations based on the original amount will revert due to the contract having...

7AI score
Exploits0
Code423n4
Code423n4
•added 2023/05/15 12:0 a.m.•11 views

Incorrect decimal handling in _startAuction, resulting in wrong auction.startBidBps

Lines of code Vulnerability details Shortfall.startAuction uses the oracle price of the underlying tokens to price the pool bad debt: Shortfall.sol 389: for uint256 i; i the price returned by priceOracle.getUnderlyingPrice has a number of decimals equal to 36 - vToken decimals. This means the...

6.7AI score
Exploits0
Code423n4
Code423n4
•added 2023/05/15 12:0 a.m.•14 views

Bad debt auctions can be DoSed forever

Lines of code Vulnerability details Vulnerability Details For function Shortfall::placeBid in shortfall contract on L183 and L190 , the previous highest bidder’s funds stored in the shortfall contract has to be sent back to the bidder. This operation has to be successful before any new bid can be...

6.6AI score
Exploits0
Code423n4
Code423n4
•added 2023/05/15 12:0 a.m.•8 views

Bad debt bidders’ funds are locked forever when Shortfall address is changed during ongoing debt auction

Lines of code Vulnerability details Vulnerability Details When the protocol accrues bad debt, it can be auctioned off to anyone who is willing to pay. Each user wanting to participate in the auction has to lock their bid in Shortfall contract: function placeBidaddress comptroller, uint256 bidBps...

6.7AI score
Exploits0
Code423n4
Code423n4
•added 2023/05/15 12:0 a.m.•14 views

Shortfall.sol#initialize's waitForFirstBidder and nextBidderBlockLimit too short

Lines of code Vulnerability details Impact File: Shortfall.sol 147 waitForFirstBidder = 100; 148 nextBidderBlockLimit = 10; Binance Smart Chain has a block time of around 3 seconds. This could lead to an attacker blocking other bids to bid for the token at a low price. Proof of Concept Tools Used...

6.7AI score
Exploits0
Code423n4
Code423n4
•added 2023/05/15 12:0 a.m.•15 views

Comptroller.exitMarket() does not get an updated exchange rate causing inacurate exit validations

Lines of code Vulnerability details Impact The user can use the exitMarket function to remove an asset from the account liquidity calculation; disabling them as collateral. The problem is that the user can call exitMarket before the vToken updates their accrue interests via accrueInterest functio...

6.5AI score
Exploits0
Code423n4
Code423n4
•added 2023/05/15 12:0 a.m.•18 views

USDC blacklisted accounts can DOS the bidding system in Shortfall

Lines of code Vulnerability details Impact Shortfall contract is used to clear off any pool bad debt via auction. If the debt reached its mimimum value, anybody can start off the auction and place the bid. Attacker can bid with tokene.g. USDC, USDT that have a contract level admin controlled...

6.8AI score
Exploits0
Code423n4
Code423n4
•added 2023/05/15 12:0 a.m.•11 views

Shortfall.sol#placeBid does not limit the bid spread

Lines of code Vulnerability details Impact Shortfall.solplaceBid does not limit the bid spread. The attacker can increase the price by a small amount each time causing the auction to never stop. Proof of Concept Tools Used manual Recommended Mitigation Steps limit the bid spread Assessed type DoS...

6.8AI score
Exploits0
Code423n4
Code423n4
•added 2022/12/20 12:0 a.m.•15 views

Borrowers may earn auction proceeds without filling the debt shortfall

Lines of code Vulnerability details Impact The proceeds from the collateral auctions will not be used to fill the debt shortfall, but be transferred directly to the borrower. Proof of Concept Assume N is an allowed NFT, B is a borrower, the vault V is vaultInfoBN: 1. B add two NFTsN-1 and N-2 as...

6.9AI score
Exploits0
Code423n4
Code423n4
•added 2022/04/12 12:0 a.m.•14 views

yVaultLPFarming: No guarantee JPEG currentBalance > previousBalance

Lines of code Vulnerability details Details & Impact yVault users participating in the farm have to trust that: vault.balanceOfJPEG returns the correct claimable JPEG amount by its strategy / strategies the strategy / strategies will send all claimable JPEG to the farm Should either of these...

7AI score
Exploits0
Code423n4
Code423n4
•added 2022/02/02 12:0 a.m.•11 views

extractTokensForCollateralShortfall can be called repeated to extract more than 50% of BPT

Handle gzeon Vulnerability details Impact During a collateral shortfall event, it is designed that the DAO can extract up to 50% of the BPT tokens. The 50% is set to limit the value the DAO can extract from the stakers. However, it is possible for the DAO to extract more than 50% by calling...

6.9AI score
Exploits0
Microsoft Malware Protection
Microsoft Malware Protection
•added 2021/10/21 4:0 p.m.•14 views

Defenders wanted—building the new cybersecurity professionals

As part of Cybersecurity Awareness Month, we published a special blog post earlier this week featuring real-world experiences shared by cybersecurity professionals: people with diverse backgrounds in law, academia, software development, and other seemingly unrelated fields. This topic is near and...

7.2AI score
Exploits0
Krebs on Security
Krebs on Security
•added 2020/03/16 12:55 p.m.•45 views

The Web’s Bot Containment Unit Needs Your Help

Anyone who's seen the 1984 hit movie Ghostbusters likely recalls the pivotal scene where a government bureaucrat orders the shutdown of the ghost containment unit, effectively unleashing a pent-up phantom menace on New York City. Now, something similar is in danger of happening in cyberspace:...

7AI score
Exploits0
Prion
Prion
•added 2019/08/27 5:15 p.m.•18 views

Cross site scripting

In Xymon through 4.3.28, an XSS vulnerability exists in the csvinfo CGI script due to insufficient filtering of the db parameter...

4.3CVSS6.1AI score0.00905EPSS
Exploits0References2Affected Software2
Carbon Black Blog
Carbon Black Blog
•added 2017/08/24 1:50 p.m.•58 views

August 24, 2017 – Morning Cyber Coffee Headlines – “Mount Vesuvius” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 24, 2017 - Headlines Carbon Black in the News: Attacking Critical...

6.6AI score
Exploits0
Tenable Nessus
Tenable Nessus
•added 2011/03/29 12:0 a.m.•13 views

AIX 610006 : U840051

The remote host is missing AIX PTF U840051 which is related to the security of the package devices.pciex.2514300014108c03.diag.6.1 You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0;...

5.5AI score
Exploits0
Tenable Nessus
Tenable Nessus
•added 2008/02/12 12:0 a.m.•10 views

AIX 530005 : U811862

The remote host is missing AIX PTF U811862 which is related to the security of the package X11.base.rte You should install this PTF for your system to be up-to-date. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc';...

5.5AI score
Exploits0
Rows per page
Query Builder