Upgraded Q -> M from #74 [1668688523897]

Judge has assessed an item in Issue 74 as M risk. The relevant finding follows: Low-7 EXCHANGE & SWAP are able to transfer any user funds to other addresses --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from #336 [1668467652322]

Judge has assessed an item in Issue 336 as M risk. The relevant finding follows: L-1: Volatility accumulator can be be prevented from decaying by way of dust transactions There is no required minimum swap amount for updating the volatility accumulated. The fp.time is always updated during a swap...

CVE-2022-42916

...

Incorrect input amount calculation for Trader Joe V1 pools

Lines of code Vulnerability details Impact Input amount is calculated incorrectly for Trader Joe V1 pools when swapping tokens across multiple pools and some of the pools in the chain are V1 ones. Calculated amounts will always be bigger than expected ones, which will always affect chained swaps...

Wrong calculation in function LBRouter._getAmountsIn make user lose a lot of tokens when swap through JoePair (most of them will gifted to JoePair freely)

Lines of code Vulnerability details Vulnerable detail Function LBRouter.getAmountsIn is a helper function to return the amounts in with given amountOut. This function will check the pair of token and tokenNext is JoePair or LBPair using binStep. If binStep == 0, it will be a JoePair otherwise it...

LBPair swap() can be front-runned, a malicious attacker can call swap with higher gas than a user, getting the user swap amount transferred to the attacker address

Lines of code Vulnerability details Impact In the LBPair.sol contract, when a user calls swap after transferring tokens to the Pair, a malicious attacker can front-run that tx then call swap on the same pair with the parameter to changed to an malicious address of his choice, paying a higher gass...

Lack of check for contract existance can cause loss of funds during transfers

Lines of code Vulnerability details Impact The current transfers will not check if the to address is for an existing token contract. This can cause loss of funds if an user attempts to make a swap for a tokens added to a pool and destructed later. Proof of Concept TokenA gets added to a pool The...

User can steal output token when input token is a rebasing token in which algebraSwapCallback can be called to expand total supply of the rebasing token

Lines of code Vulnerability details Impact When calling the swap function below, the following swapCallback function is further called for calling the algebraSwapCallback function in the callee contract that is msg.sender; such contract does not have to be a shared router and can be separately...

Incorrect volatility on range calculation

Lines of code Vulnerability details Impact Incorrect calculation of volatility impairs the adaptive swap fee calculation. Actual swap fees may be bigger or smaller than expected. Proof of Concept According to the Tech Paper, volatility during the period $\Delta t$ is calculated as follows:...

Output token shouldn't be pulled from the caller in the swap

Lines of code Vulnerability details Impact Output token shouldn't be pulled from the caller in the swap. Since the output token shouldn't be sent to the caller when performing a swap as it is the token that the user should be received, it will always revert if the amount of output token...

Vulnerability of the fileio.c component, /etc/shadow, /etc/.shadow.swp, and the text editor Vim, allowing an attacker to access confidential data

The vulnerability of the fileio.c component, /etc/shadow, and /etc/.shadow.swp from the Vim text editor is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability allows an attacker to gain access to confidential data...

The user Can't swap their frxETH to ETH

Lines of code Vulnerability details Impact I’m so confused I didn't find any logic to withdrawing my funds ETH by transferring my frxETH Recommended Mitigation Steps Create logic for withdrawals swap --- The text was updated successfully, but these errors were encountered: All reactions...

OESA-2022-1949 xorg-x11-server security update

Security Fixes: A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in the SProcRenderCompositeGlyphs function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

GSD-2022-1005028 mm/mprotect: only reference swap pfn page if type match

mm/mprotect: only reference swap pfn page if type match This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.6 by commit...

Lack of input array length check in UNSAFE_swapExactTokensForTokens() could lock user's funds

Lines of code Vulnerability details Impact In case the amounts and routes array do not match in length by mistake: the swap might fail the swap could stop early during the swap path user funds could be locked forever in some situations Proof of Concept src/Swap/BaseV1-periphery.sol function...

Stable/non-stable pair creation mistake could be abused

Lines of code Vulnerability details Impact Stable and non-stable pair use different formula to calculate the invariant k. If a non-stable pair is treated as stable, or vice versa. $x^3y+y^3x$ behave quite differently compare with $xy$, on the edge of relative stable price range, price volatility...

Swap at the lower cushion is impossible due to non approved withdrawal. Wrong implementation can cause free swaps.

Lines of code Vulnerability details Impact Currently it is not clear how the swap user is approved for withdrawing from treasury. Depending on implementation, user could swap without spending any tokens, due to approval mechanism in the TRSRY module. Description In the swap function it should be...

interest rate calculate vulnerability

Lines of code Vulnerability details Impact function addinterst uses the interest rate immediately generated by the current block first transaction calculated,it will cause some interest lose. Proof of Concepmt function addinterst uses the interest rate immediately generated by the current block t...

Monero: Reentrancy attack in eth-monero atomic swap

A reentrancy vulnerability was found in the eth-xmr atomic swap smart contract, allowing an attacker to drain almost all of the ethers from the smart contract. The vulnerability was fixed in a later version of the smart contract...

rbData.toCollateral address can be different than the token address set in swapData.dexTxData.

Lines of code Vulnerability details Impact rbData.toCollateral address can be different than the token address set in swapData.dexTxData. A manager can supply toCollateral address of the collateral within the contract but supply a different address in swapParams.dexTxData such that the contract...