amount requires to be updated to contract balance increase (5)

Lines of code Vulnerability details Impact Every time transferFrom or transfer function in ERC20 standard is called there is a possibility that underlying smart contract did not transfer the exact amount entered. It is required to find out contract balance increase/decrease after the transfer. Th...

_amount requires to be updated to contract balance increase (4)

Lines of code Vulnerability details Impact Every time transferFrom or transfer function in ERC20 standard is called there is a possibility that underlying smart contract did not transfer the exact amount entered. It is required to find out contract balance increase/decrease after the transfer. Th...

amount requires to be updated to contract balance increase (5)

Lines of code Vulnerability details Impact Every time transferFrom or transfer function in ERC20 standard is called there is a possibility that underlying smart contract did not transfer the exact amount entered. It is required to find out contract balance increase/decrease after the transfer. Th...

Unlimited reward minting with Function Transfer in StakerVault (updates balances before calling userCheckpoint)

Lines of code Vulnerability details Impact The bug in "StakerVault.transfer" function which is externally callable is that first it is updating the balance of sender and receiver then it calls ILpGaugelpGauge.userCheckpoint for those addresses. Function userCheckpoint use balance of address to...

Lend and borrow tickets can be transferred to the NFTLoanFacilitator

Lines of code Vulnerability details Impact Both lend and borrow tickets can be intentionally or accidentally transferred to the NFTLoanFacilitator contract. Since the NFTLoanFacilitator has no mechanism for rescuing these tokens or preventing their transfer, borrowers may be unable to repay,...

Token Transfers Are Not Handled Correctly

Lines of code Vulnerability details Impact The transfer function is used to send royalty assets to the splitter contract and its recipients. If the vault operates on non-standard ERC20 tokens, its possible for transfers to not revert upon failure. Similarly, transferFrom is used to pull funds fro...

Reentrancy in ConcurRewardPool::claimRewards

Lines of code Vulnerability details Impact Any address that has nonzero reward for a token tokensi is able to drain all contact token funds if the transfer function is reentrant for example, ERC777 token. As tokensi is an arbitrarily implemented, a reentrant transfer function can be assumed to be...

Transfer function is unreliable

Handle Koustre Vulnerability details Impact Opcode pricing is not stable and should not be relied upon to protect against re-entrancy attacks. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept...

Erc20.transfer() return value is ignored

Handle pants Vulnerability details According to the ERC-20 Token Standard, the function transfer returns false on failure. However, the return value of Erc20.transfer is ignored 8 times: 1. In Swivel.exitVaultFillingZcTokenExit, line 313. 2. In Swivel.exitVaultFillingZcTokenExit, line 315. 3. In...

Rewards accumaulated can stay constant and oftern not increment

Handle moose-code Vulnerability details Impact rewardsPerToken.accumulated can stay constant while rewardsPerToken.lastUpdated is continually updated, leading to no actual rewards being distributed. I.e. No rewards accumulate. Proof of Concept Line 115, rewardsPerToken.accumulated could stay...

Unchecked return value from transfer()

Handle JMukesh Vulnerability details Impact It is usually good to add a require-statement that checks the return value or to use something like safeTransfer; unless one is sure the given token reverts in case of a failure. Proof of Concept Tools Used manual review Recommended Mitigation Steps che...

CVE-2021-33403

An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses between two large accounts during a transaction...

instead of call() , transfer() is used to withdraw the ether

Handle JMukesh Vulnerability details Impact function withdrawuint amount external requireamount = ethBalancemsg.sender; ethBalancemsg.sender = ethBalancemsg.sender.subamount; msg.sender.transferamount; emit Withdrawmsg.sender, amount; To withdraw eth it uses transfer, this trnansaction will fail...

Bypass or reduction on the lockup period of Pool FDTs.

Handle shw Vulnerability details Editing on a previous submission to clarify more details Impact In Pool.sol, the lockup restriction of withdrawal Pool.sol396 can be bypassed or reduced if new liquidity providers cooperate with existing ones. Proof of Concept 1. A liquidity provider, Alice,...

Pandora Digital Error Vulnerability

Pandora PDX is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'transfer' and 'transferFrom' functions in the smart contract implementation of PDX. An attacker could exploit the vulnerability to set a user's balance to an arbitrary value...

The vulnerability of the TIFFWriteDirectoryTagTransferfunction function in software for viewing, editing, and converting TIFF files arises from the possibility of an operation exceeding the permissible buffer data size. This vulnerability allows attackers to cause service failures.

The vulnerability of the TIFFWriteDirectoryTagTransferfunction function in software for viewing, editing, and converting TIFF files is related to the operation exceeding the allowable buffer data size. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

Linux kernel denial of service vulnerability (CNVD-2020-28264)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the drivers/spi/spi-dw.c file in Linux kernel versions prior to 5.4.17. An attacker can exploit this vulnerability to cause a denial...

Easy Trading Token Digital Error Vulnerability

Easy Trading Token ETT is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'transfer' and 'transferFrom' functions in ETT's smart contract implementation. . An attacker can exploit this vulnerability to modify arbitrary amounts...

Pandora Digital Error Vulnerability

Pandora PDX is an ethereum-based digital currency.An integer overflow vulnerability exists in the 'transfer' and 'transferFrom' functions in the smart contract implementation of PDX. An attacker could exploit the vulnerability to set a user's balance to an arbitrary value...

PFGc Number Error Vulnerability

PFGc is an ethereum-based digital currency.An integer overflow vulnerability exists in the smart contract implementation of PFGc in the 'transfer', 'transferFrom', and 'mint ' functions in the PFGc smart contract implementation suffer from an integer overflow vulnerability. An attacker could...