DOS attack to RedeemTo() and GetUnderlyingTokens(), leading to loss of funds.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. An attacker can launch a DOS attack to RedeemTo and GetUnderlyingTokens so that it will always fail for a particular account, say Bob. In this way, Bob will not be able to redeem the MuteToken locked...

CVE-2023-28677

Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build Steps, and Post-build Actions to the equivalent Pipeline step invocations, allowing attackers able to configure Freestyle projects to prepare a crafted...

Citrix Endpoint Management (aka XenMobile Server) 10.14.0 Rolling Patch 10

Package name: xms10.14.0.11013.bin For: XenMobile Server 10.14.0 Deployment type: On-premises only Replaces: xms10.14.0.10942.bin, xms10.14.0.10813.bin, xms10.14.0.10742.bin, xms10.14.0.10628.bin, xms10.14.0.10521.bin, xms10.14.0.10424.bin, xms10.14.0.10303.bin, xms10.14.0.10206.bin, and...

Potential lose of Vault control

Lines of code Vulnerability details Impact If by any means this function is not called first by the creators anyone can be the one to define it forever since there is no verification, after that the attacker will have complete control over the mint and burn functions. Proof of Concept function...

Owner is able to mint 1 token more than 1000 prelaunch tokens due to wrong equality check

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. Owner is able to mint 1 token more than 1000 prelaunch tokens due to wrong check here Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant...

No access control in mint function

Lines of code Vulnerability details Impact Canto Bio Protocol: Should allow the association of a single biography to an identity address The mint function does not have any access control mechanism in place, allowing anyone to mint multiple Bio NFTs. This could lead unwanted minting of bios. Tool...

Centralization privileges could cause revenue loss or DDoS

Lines of code Vulnerability details Impact DISCLAIMER: I understand that this was under known issues M-1, and I'm submitting this on another angle which is in case owner is compromised. Namespace and Tray contract allow the owner to execute some privilege actions which give flexibility but at the...

Implementation error in Namespace.fuse() leads to a wrong unicode representation

Lines of code Vulnerability details Impact The font class of a tile will be always considered as 0 emoji when a user registers a name. Proof of Concept To register a name, fuse is used taking as input the data of the characters. The name to register is a string created by converting the character...

Lack of token approval reverts the overall trade

Lines of code Vulnerability details Impact Since the user has not approved the params.collateralAmount, calling the safeTransferFrom function will result in a revert due to the lack of token approval. The Exchange contract not receive any collateralAmount. Proof of Concept...

Namespace.sol fuse() function incorrectly calculates fused bytes

Lines of code Vulnerability details Impact The fuse function in Namespace.sol incorrectly calculates fused bytes. The first parameter to the characterToUnicodeBytes function is font class, which is always set to 0. This leads to an incorrect calculation of the tokenToName value, resulting in a...

totalFunds update is missing in Liquidity.openShort

Lines of code Vulnerability details Impact totalFunds is not updated in Liquidity.openShort so totalFunds will be wrong. Proof of Concept Liquidity.openShort updates usedFunds only and doesn't update totalFunds. totalFunds should be updated after openShort. Tools Used Manual Review Recommended...

Why does prelaunch checking do only for namespaceNFT case in Tray.burn?

Lines of code Vulnerability details Impact In function Tray.burnid, we can see prelaunchMinted checking. But that part is inside if msg.sender == namespaceNFT. We should take care about it in all cases. Proof of Concept function burnuint256 id external address trayOwner = ownerOfid; if namespaceN...

Incorrect use of the && Operator will allow anyone to fuse a new Namespace NFT

Lines of code Vulnerability details Impact Any caller can easily mint NFT if they provide a valid list of characters with the appropriate trays, the problem with this code is in this check if trayOwner != msg.sender && tray.getApprovedtrayID != msg.sender && !tray.isApprovedForAlltrayOwner,...

Unlimited minting of Canto Bio NFT

Lines of code Vulnerability details Impact There is no max limit on the number of Bio NFT that can be minted by a user. This allows an attacker to mint himself any amount of Bio NFT he want. Proof of Concept function testMint public string memory bio = "TEST BIO"; vm.prankalice; for uint i = 0; i...

Namespace tokenName has only emojis.

Lines of code Vulnerability details Impact The tokenName and image of Namespace should always be the same. The image is correct but the tokenName only consists of emojis. Duplicate names are checked on the tokenName and not on the image. Because of this a tile of font class 1 with character index...

Unsafe safeTransfer function

Lines of code Vulnerability details Impact The safeTransfer function of the SafeERC20.sol contract check that the target is actually a contract before calling it, this is to avoid calls to address with no code that will always return succes = true. For exemple if you use token.safeTransfer and...

Unsafe system contract verification

Lines of code Vulnerability details Impact On the following function: function isSystemContractaddress address internal pure returns bool return uint160address = uint160MAXSYSTEMCONTRACTADDRESS; it does check whether an address is a system contract by checking whether it is smaller than...

Gas check inaccuracy

Lines of code Vulnerability details Impact Since the gas forwarded will be limited to 63/64 of the total gasleft, L1 transactions will be vulnerable of being reverted. To achieve 1:1 partity with the EVM, the ZKEVM should account for 1/64 rule. Please refer to the 1/64 rule here. The actual amoun...

Wrong Implementation of EIP-712

Lines of code Vulnerability details Impact The EIP-712 uses several parameters. Those parameters are exactly: EIP712Domain string name; string version; uint256 chainId; address verifyingContract; As you can see on the following Domain, ZkSync, is missing one parameter: bytes32 constant...

Wrong block number calculation

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The calculation for the block info is currentBlockNumber + 1 BLOCKINFOBLOCKNUMBERPART + newTimestamp. getBlockNumberAndTimestamp, getBlockTimestamp, getBlockNumber all incorrectly calculate the current...