PT-2026-98192

Name of the Vulnerable Software and Affected Versions ixo Blockchain versions prior to 8.0.0 Description Improper authorization in the x/bonds module allows the movement of funds from an address resolved from a DID verification method without verifying if the address belongs to the transaction...

EUVD-2023-0387

Malicious code in bioql PyPI...

CVE-2024-54134

CVE-2024-54134 affects the Solana JavaScript library solana/web3.js, specifically versions 1.95.6 and 1.95.7. A publish-access account was compromised, enabling attackers to publish unauthorized malicious packages that could exfiltrate private key material and drain funds from dapps that handle p...

GO-2024-2874 Inter-Blockchain Communication (IBC) protocol "Huckleberry" vulnerability in github.com/cosmos/ibc-go

The ibc-go module is affected by the Inter-Blockchain Communication IBC protocol "Huckleberry" vulnerability. The vulnerability allowed an attacker to send arbitrary transactions onto target chains and trigger arbitrary state transitions, including but not limited to, theft of funds. It was...

Lack of input validation for ClosePositionParams.amountSwap results in theft of fund (premium + protocol fee))

Lines of code Vulnerability details Impact Lack of input validation for ClosePositionParams.amountSwap results in theft of fund Proof of Concept ParticlePositionManager.sol hold two part of fund 1. the contract hold premium added by borrower 2. the contract hold protocol fee before protocol...

CVE-2023-38701: Improper Input Validation

Hydra is the layer-two scalability solution for Cardano. Users of the Hydra head protocol send the UTxOs they wish to commit into the Hydra head first to the commit validator, where they remain until they are either collected into the head validator or the protocol initialisation is aborted and t...

Attacker can steal funcds from InterchainProposalExecutor contract

Lines of code Vulnerability details Impact In InterchainProposalSender users can send proposals to diffrent chains by passing the call data InterchainCalls.Call into sendProposals or sendProposal functions, this struct contains another struct Call which contains target, value and call data, but...

If the controller for _data.projectId is not defined, it can lead to incorrect execution of _swap() and theft of funds by the beneficiary.

Lines of code Vulnerability details Impact If the controller is not defined in the swap function, then it becomes impossible to mint and burn tokens, which leads to incorrect execution of the function. IJBController controller = IJBControllerjbxTerminal.directory.controllerOfdata.projectId; Proof...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

CVE-2023-31290: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

Uniswap Universal Router Incorrect Authorization vulnerability

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds...

CVE-2022-48216

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds...

CVE-2022-48216

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds...

CVE-2022-48216

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds...

CVE-2022-48216

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds...

CVE-2022-48216: Improper Locking

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds...

Buyers unused ETH funds can be stolen (Direct theft of funds)

Lines of code Vulnerability details Impact The protocol has recognized the need to track buyers ETH in order to refund unused ETH by implementing the returnDust function and setupExecution modifier. The implementation creates an attack vector that allows the seller to steal the unused ETH...

CVE-2020-26896

Prior to 0.11.0-beta, LND Lightning Network Daemon had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount...