Malicious code in sushiswap-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0a1bec1276314a1ddbdeb526d00f4c4c1a589888cd7e5aa1b3c10fee3622970 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6365 Malicious code in sushiswap-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0a1bec1276314a1ddbdeb526d00f4c4c1a589888cd7e5aa1b3c10fee3622970 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview sushiswap-analytics is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

Malicious code in sushiswap-shiny-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5c53008b29715ecd11e4c96835c21437139b870a2d36510e971be22cb33598e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6366 Malicious code in sushiswap-shiny-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5c53008b29715ecd11e4c96835c21437139b870a2d36510e971be22cb33598e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UniswapV2TokenAdapter does not support Sushiswap-only assets

Handle cmichel Vulnerability details The UniswapV2TokenAdapter.supports function calls its aboveLiquidity function which returns the UniswapV2 liquidity if the pair exists. If this is below minimumLiquidity, the supports function will return false. However, it could be that the Sushiswap pair has...

ConcentratedLiquidityPoolManager.sol#claimReward() and reclaimIncentive() will fail when incentive.token is token0 or token1

Handle WatchPug Vulnerability details In ConcentratedLiquidityPosition.collect, balances of token0 and token1 in bento will be used to pay the fees. uint256 balance0 = bento.balanceOftoken0, addressthis; uint256 balance1 = bento.balanceOftoken1, addressthis; if balance0 newBalance0 token0amount =...

absolute difference is not calculated properly when a > b in MathUtils

Handle hack3r-0m Vulnerability details the difference is computed incorrectly when a b. As it only used in within1 function, scope narrows down to where differencea, b It is possible to decrease the denominator and increase the value of the numerator when calculating y using constants and input t...

IndexPool.sol#_pow() Wrong implementation

Handle WatchPug Vulnerability details function powuint256 a, uint256 n internal pure returns uint256 output output = n % 2 != 0 ? a : BASE; for n /= 2; n != 0; n /= 2 a = a a; if n % 2 != 0 output = output a; 1. a a without div by BASE will accumulate decimals unexpectedly and leads to overflow...

IndexPool.mint() Unchecked arithmetic can overflow that allows stealing of almost all the funds in the pool

Handle WatchPug Vulnerability details /// @dev Mints LP tokens - should be called via the router after transferring bento tokens. /// The router must ensure that sufficient LP tokens are minted by using the return value. function mintbytes calldata data public override lock returns uint256...

PostAuctionLauncher's liquidity provision can be exploited

Handle cmichel Vulnerability details The PostAuctionLauncher.finalize function takes the raised payment token amounts and uses previously provided auction token amounts to provide liquidity to a Sushiswap pool after an auction has successfully been finalized. It provides this liquidity at a...

PostAuctionLauncher.sol#finalize() Adding liquidity to an existing pool may allows the attacker to steal most of the tokens

Handle WatchPug Vulnerability details PostAuctionLauncher.finalize can be called by anyone, and it sends tokens directly to the pair pool to mint liquidity, even when the pair pool exists. An attacker may control the LP price by creating the pool and then call finalize to mint LP token with unfai...