Loss of previous spending power for same spender address in Treasury Contract

Lines of code Vulnerability details Line of code: Impact Lose of previous spending power for same address in TreasuryContract Proof of Concept the AracheTreasury, there are three spending relate function: approveSmallSpend, approveMediumSpend, approveLargeSpend both of these function call...

Front run attacks during the 7 day cooldown period in setGSCAllowance.

Lines of code Vulnerability details Impact A malicious miner can send a transaction from the GSC to drain the new allowance before the admin's transaction sets it. Proof of Concept The setGSCAllowance function sets a 7 day cooldown period between allowance changes for each token. This prevents th...

Missing Validation which could cause Underflow Error

Lines of code Vulnerability details Impact Two instances of Missing Validation which could cause Underflow Error are spotted at L194 and L593 of NFTBoostVault.sol contract, from L194 there is no check to validate that oldDelegateeVotes is greater than registration.latestVotingPower and from L593...

Malicious proposal can drain the treasury contract and bypass the gscAllowance[token] check

Lines of code Vulnerability details Impact Malicious proposal can drain the treasury contract and bypass the gscAllowancetoken check Proof of Concept See this two function: function gscSpend address token, uint256 amount, address destination external onlyRoleGSCCOREVOTINGROLE nonReentrant if...

withdrawFees Have a vulnerability leading to

Lines of code Vulnerability details Impact Thé withdrawFees function allows the manager to withdraw all ETH fees from the contract., this function uses the transfer method here the vulnerable part: function withdrawFeesaddress recipient external onlyRoleBADGEMANAGERROLE if recipient == address0...

voting power is insufficiently tracked

Lines of code Vulnerability details Impact Historical balance tracking of votingPower is not stored due to values being updated in memory rather than storage. This means old delegatees may retain voting power which should have been removed from them, new delegatees may not not receive their...

User able to steal all votes escrowed in LockingVault due to downcasting

Lines of code Vulnerability details Even though the LockingVault is considered out of scope, it contains very serious vulnerability allowing anyone to steal ALL Arcade voting tokens. The vulnerability is possible due to downcasting amount to withdraw to uint96. In case that the amount of tokens...

GHSA-G9W4-PRF3-M25G Obfuscated email addresses should not be sorted

Impact The mail obfuscation configuration was not fully taken into account and is was still possible by obfuscated emails. See https://jira.xwiki.org/browse/XWIKI-20601 for the reproduction steps. Patches This has been patched in XWiki 14.10.9, and XWiki 15.3-rc-1. Workarounds The workaround is t...

Unrestricted Access to setRoyalty Function

Lines of code Vulnerability details Impact Severity: High Likelihood: High Description The setRoyalty function in the ERC2981CollectionRoyalties contract can be called by anyone. This function is used to set the royalty information for a specific token ID. However, because there are no access...

PT-2023-23345 · Fsmlabs · Fsmlabs Timekeeper

Name of the Vulnerable Software and Affected Versions: FSMLabs TimeKeeper version 8.0.17 Description: A cross-site scripting XSS issue was found, allowing for the injection of JavaScript code on specific screens. The affected screens include "Configuration - Compliance - Add a new compliance...

The is no way for native tokens to get sent to InterchainProposalExecutor

Lines of code Vulnerability details Impact Proposals that require value cannot be executed as native tokens on the other side of the bridge cannot be provided. Proof of Concept Proposals have a value parameter, which allows users to specify what amount of native tokens should be passed when calli...

[H] Users can lose their funds if the transaction reverts on destination chain

Lines of code Vulnerability details Impact The transmitSendToken function in the contract facilitates cross-chain token transfers. For contracts involving ERC20 tokens it is also expected that, should a contract call fail, one's tokens are not lost/transferred elsewhere. However, the function doe...

Permits may be reused after token upgrade

Lines of code Vulnerability details Impact The StandardizedToken contract inherits the ERC20Permit contract which in the case of an upgradable/proxied Token would allow permits for a previous version of the Token to be used on any subsequent version of it. NOTE that ERC20Permit is not explicitly ...

newGovernance COULD BE SET TO A WRONG ADDRESS THUS FREEZING CERTAIN FUNCTIONS

Lines of code Vulnerability details Impact The AxelarGateway.transferGovernance function is used to set the newGovernance address in the storage of the AxelarGateway contract. It is performed as follows: function transferGovernanceaddress newGovernance external override onlyGovernance if...

funds can be stolen in InterchainGovernance, Multisig and AxelarServiceGovernance contracts

Lines of code Vulnerability details Impact In InterchainGovernance users can execute the proposal by passing required data and the amount of native value they want to send with executeProposal function, this function calls call function in Caller contract, but this function insted of checking...

EL Injection Vulnerability in Hitachi Replication Manager

Overview An EL Injection Vulnerability CVE-2022-4146 exists in Hitachi Replication Manager. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate action...

CONFIGURING ALLOWANCE TO ZERO FOR THE _previousLiquidationPair CAN BE FRONT RUN

Lines of code Vulnerability details Impact The Vault.setLiquidationPair is used to change the liquidationPair address to a new address. In the process it sets the allowance of the previousLiquidationPair to zero as shown below: if previousLiquidationPair != address0...

No access control on mintYieldFee

Lines of code Vulnerability details Impact Lack of access-control allows anyone to mint the yield fee to himself. Proof of Concept Vault.mintYieldFee does not restrict the recipient yield fees: function mintYieldFeeuint256 shares, address recipient external requireVaultCollateralized; if shares...

Failed transfer with low level call could be overlooked

Lines of code Vulnerability details Impact Transfers may fail silently. Proof of Concept According to the Solidity docs: "The low-level functions call, delegatecall and staticcall return true as their first return value if the account called is non-existent, as part of the design of the EVM...

balanceOf method can be manipulate to liquidated vault

Lines of code Vulnerability details Impact Deriving price from balanceOf can be manipulated to liquidate vault see example Attacker can provide ERC20 token to the vaultAsset and mint vault shares. The deposited tokens will then be withdrawn with having same shares in the vault. The shares then wi...