CVE-2023-35163

Vega before 0.71.6 is affected: a malicious validator can trick the network into re-processing past Ethereum-bridge events, enabling multiple replays (e.g., a 100 USDT deposit crediting 5,000 USDT across a party’s Vega general account). The flaw arises from how ChainEvent data can be duplicated b...

CVE-2023-35163 Vega's validators able to submit duplicate transactions

Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For exampl...

CVE-2023-35163 Vega's validators able to submit duplicate transactions

Vega is a decentralized trading platform that allows pseudo-anonymous trading of derivatives on a blockchain. Prior to version 0.71.6, a vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For exampl...

Beijing Douniu Network Technology Co., Ltd Douniu APP has information leakage vulnerability

Bean Cow APP is an online wholesale trading platform for agricultural and sideline products. Ltd. Bean cow APP has information leakage vulnerability, attackers can use the vulnerability to obtain sensitive information on the server...

RToken.redeem should claim rewards before sending tokens to user

Lines of code Vulnerability details Impact RToken.redeem should claim rewards before sending tokens to user. Because after that he will not receive them anymore. Proof of Concept When user mints RToken, then he sends some tokens as collateral and they are stored by BackingManager. Some of...

royal-trading.jp Cross Site Scripting vulnerability OBB-3380671

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Sponsored Twitter post uses fake BBC News site to boost slippery oil trading app

A sponsored post on Twitter promises to offer the benefits of obtaining citizenship, but really just wants to lure you into some form of Forex trading AI scheme. This tangled web also includes faked BBC web pages and suspicious-looking website reviews to round the whole thing off. Shall we take a...

7 Rules Of Risk Management For Cryptocurrency Users

By Owais Sultan Trading or investing in cryptocurrencies can be highly lucrative. But the extreme price movements often discourage beginners to… This is a post from HackRead.com Read the original post: 7 Rules Of Risk Management For Cryptocurrency Users...

daytradingacademy.com Cross Site Scripting vulnerability OBB-3301615

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

deltatrading.info Cross Site Scripting vulnerability OBB-3273217

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Lazarus X_TRADER Hack Impacts Critical Infrastructure Beyond 3CX Breach

Lazarus, the prolific North Korean hacking group behind the cascading supply chain attack targeting 3CX, also breached two critical infrastructure organizations in the power and energy sector and two other businesses involved in financial trading using the trojanized XTRADER application. The new...

Lazarus X_TRADER Hack Impacts Critical Infrastructure Beyond 3CX Breach

Lazarus, the prolific North Korean hacking group behind the cascading supply chain attack targeting 3CX, also breached two critical infrastructure organizations in the power and energy sector and two other businesses involved in financial trading using the trojanized XTRADER application. The new...

N.K. Hackers Employ Matryoshka Doll-Style Cascading Supply Chain Attack on 3CX

The supply chain attack targeting 3CX was the result of a prior supply chain compromise associated with a different company, demonstrating a new level of sophistication with North Korean threat actors. Google-owned Mandiant, which is tracking the attack event under the moniker UNC4736 , said the...

Routing griefing via ERC-777 operator

Lines of code Vulnerability details Impact Currently, there is no router implemented for private pools in which NFTs are traded against ERC-20 tokens or it is not available in the repository. However, in the future, it is possible that some algorithm on the frontend will look for the optimal path...

A hacker can front-run the owner of a PrivatePool to drain the pool

Lines of code Vulnerability details Impact A hacker can sandwitch calls to setVirtualReserves or setMerkleRoot in a private pool and make an instant profit at the expense of the owner. For example, the hacker sees that there is a setVirtualReserves transaction in the mempool that will make the NF...

baseball-trading-cards.com Cross Site Scripting vulnerability OBB-3233477

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Managing Risk in Crypto Trading: Techniques for Minimizing Your Exposure to Market Volatility

By Owais Sultan Crypto trading might be a successful method to gain money, but it is not without risks. A trader… This is a post from HackRead.com Read the original post: Managing Risk in Crypto Trading: Techniques for Minimizing Your Exposure to Market Volatility...

ION starts bringing customers back online after LockBit ransomware attack

ION Group, a financial software firm, is reportedly beginning to bring clients back online after being hit by a ransomware attack late last week. The Russian-linked LockBit ransomware group claimed responsibility for attacking a division of ION Group, which affecting 42 clients in Europe and the...

The _verifyTime function only reverts if revertOnInvalid is true and the order is not active.

Lines of code Vulnerability details Impact The verifyTime function only reverts if revertOnInvalid is true and the order is not active. This means that if revertOnInvalid is not passed or is false, the function will not revert even if the order is not active. It could have a significant impact on...

Upgraded Q -> M from #658 [1674423084300]

Judge has assessed an item in Issue 658 as M risk. The relevant finding follows: L-04 USDT IS NOT SUPPORTED FOR CALLING Trading.handleDeposit FUNCTION ON ETHEREUM MAINNET As shown by , USDT on the Ethereum mainnet does not allow approving a new amount when the existing approved amount is not zero...