Attacker can steal entire reserves by abusing fee calculation

Lines of code Vulnerability details Description Similar to other LP pools, In Trader Joe users can call mint to provide liquidity and receive LP tokens, and burn to return their LP tokens in exchange for underlying assets. Users collect fees using collectFessaccount,binID. Fees are implemented...

Incorrect input amount calculation for Trader Joe V1 pools

Lines of code Vulnerability details Impact Input amount is calculated incorrectly for Trader Joe V1 pools when swapping tokens across multiple pools and some of the pools in the chain are V1 ones. Calculated amounts will always be bigger than expected ones, which will always affect chained swaps...

Upgraded Q -> M from 307 [1655245513660]

Judge has assessed an item in Issue 307 as Medium risk. The relevant finding follows: Low feeRate can be modified for existing vaults feeRate is a parameter that controls the fee applied on exercise. It can be set by the function: function setFeeuint256 feeRate external onlyOwner feeRate = feeRat...

Add reentracy protections on function executeTrade

Handle shw Vulnerability details Impact As written in the to-do comments, reentrancy could happen in the executeTrade function of Trader since the makeOrder.market can be a user-controlled external contract. Proof of Concept Referenced code: Trader.solL121-L126 Recommended Mitigation Steps Add a...

Lack of nonreentrant modifier or CEI pattern may lead to reentrancy

Handle 0xRajeev Vulnerability details Impact The Trader contract makes an external call to the market contract TracerPerpetualSwaps as part of executeTrade. The comments in code "// todo this could be succeptible to re-entrancy as // market is never verified” indicate that there could be a residu...

Trader orders can be frontrun and users can be denied from trading

Handle cmichel Vulnerability details The Trader contract accepts two signed orders and tries to match them. Once they are matched and become filled, they can therefore not be matched against other orders anymore. This allows for a griefing attack where an attacker can deny any other user from...

Command Execution Vulnerability in Yimin Trader Zhiying

Founded in 2005, Yimin Co., Ltd. provides customers with three major businesses, namely, securities assisted decision-making software, investor education, and investment consulting, and is committed to improving the profitability of its users. Tencent is the second largest shareholder of the...

Command Execution Vulnerability in Yimin Trader Financial Platform Qiankun Edition

Founded in 2005, Yimin Co., Ltd. provides customers with three major businesses, namely, securities assisted decision-making software, investor education, and investment consulting, and is committed to improving the profitability of its users. Tencent is the second largest shareholder of the...

brisbanetrader.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1157752 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting brisbanetrader.com website...

Command Execution Vulnerability in Yimin Trader Zhiying PC Version

Yimin Trader Smart Profit for PC is a computerized securities finance tool. Yimin Trader Zhiying PC Edition has a command execution vulnerability that can be exploited by attackers to execute malicious code...

yanmarenginetrader.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1129143 Security Researcher Gh05tPT Helped patch 6884 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting yanmarenginetrader.com...

mitsubishienginetrader.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1129138 Security Researcher Gh05tPT Helped patch 6901 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting mitsubishienginetrader.c...

Code Execution Vulnerability in Yimin Trader Jiying

Yimin Trader Smart Earnings is a stock investors special computerized securities finance tools. Yimin Trader Zhiying has a code execution vulnerability that can be exploited by attackers to execute arbitrary code...

godmode-trader.de XSS vulnerability

Open Bug Bounty ID: OBB-706613 Description| Value ---|--- Affected Website:| godmode-trader.de Open Bug Bounty Program:| View Open Bug Bounty Program Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

as.godmode-trader.de Open Redirect vulnerability

Open Bug Bounty ID: OBB-706388 Description| Value ---|--- Affected Website:| as.godmode-trader.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| hidden until...

CVE-2018-10097

XSS exists in Domain Trader 2.5.3 via the recoverlogin.php emailaddress parameter...

CVE-2018-10097

XSS exists in Domain Trader 2.5.3 via the recoverlogin.php emailaddress parameter...

Cross site scripting

XSS exists in Domain Trader 2.5.3 via the recoverlogin.php emailaddress parameter...

CVE-2018-10097

CVE-2018-10097 describes a cross-site scripting vulnerability in Domain Trader version 2.5.3, exploitable via the recoverlogin.php email_address parameter. The issue is a client-side/script injection flaw in that input parameter, enabling arbitrary script/HTML to be injected when processed by the...

CVE-2018-10097

XSS exists in Domain Trader 2.5.3 via the recoverlogin.php emailaddress parameter...