Malicious code in wallet-add-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f669adaac6e6303053b5a1d293a7250bd6a4f8e3c3fa52f941d1a1c4497955a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-27518 · Freighter · Freighter

Name of the Vulnerable Software and Affected Versions: Freighter versions prior to 5.3.1 Description: The issue impacts access control to the mnemonic recovery phrase, potentially allowing a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked...

Benefits of Using an Anonymous Bitcoin Wallet in 2023

By Owais Sultan An anonymous Bitcoin wallet makes it possible to extend the level of anonymity when transferring cryptocurrencies to a… This is a post from HackRead.com Read the original post: Benefits of Using an Anonymous Bitcoin Wallet in 2023...

Cryptographic Flaw in Libbitcoin Explorer Cryptocurrency Wallet

Cryptographic flaws still matter. Heres a flaw in the random-number generator used to create private keys. The seed has only 32 bits of entropy. Seems like this flaw is being exploited in the wild. EDITED TO ADD 8/14: A good explainer...

Delegation empowers more voting weight than expected

Lines of code Vulnerability details Description and Impact The user's voting power decreases linearly from the moment of the lock. To prevent this decrease, users can delegate their voting power to a new wallet. Here is an example scenario illustrating this: 1. The user owns two wallets, Wallet A...

Design/Logic Flaw

Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt 256 in total because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed...

Design/Logic Flaw

Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...

CVE-2023-33242 Lindell17 TSS Abort Mishandling

Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt 256 in total because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed...

CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...

Design/Logic Flaw

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...

CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...

CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...

GG18 TSS and GG20 TSS Injection Vulnerabilities

tss-lib is an open source IO FinNet implementation of the multi-party t,n- threshold ECDSA Elliptic Curve Digital Signature Algorithm based on Gennaro and Goldfeder 20201 and EdDSA Edwards Curve Digital Signature Algorithm. A security vulnerability exists in the GG18 , GG20 TSS that stems from...

CVE-2023-39910

The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. The use of an mt19937 Mersenne Twister PRNG restricts the internal entropy to 32 bits regardless of settings. This allows remote attackers to recover any wallet...

Lindell17 TSS Injection Vulnerability

tss-lib is an open source IO FinNet implementation of the multi-party t,n- threshold ECDSA Elliptic Curve Digital Signature Algorithm based on Gennaro and Goldfeder 20201 and EdDSA Edwards Curve Digital Signature Algorithm. A security vulnerability exists in Lindell17 TSS that stems from allowing...

CVE-2023-39910

CVE-2023-39910 (Milk Sad) affects Libbitcoin Explorer 3.0.0–3.6.0. The wallet entropy seeding uses an mt19937 PRNG, constraining internal entropy to 32 bits regardless of settings, enabling attackers to recover wallet private keys from residual memory and steal funds. The description notes this w...

PT-2023-5500

Name of the Vulnerable Software and Affected Versions Libbitcoin Explorer versions 3.0.0 through 3.6.0 Description The issue is related to the use of a weak cryptocurrency wallet entropy seeding mechanism in Libbitcoin Explorer, also known as the Milk Sad issue. This weakness allows remote...

call() should be used instead of transfer() on an address payable

Lines of code Vulnerability details Impact The use of the transfer function for sending ETH to an address will inevitably make the transaction fail when: The claimer smart contract does not implement a payable function. The claimer smart contract does implement a payable fallback which uses more...

Information Disclosure

dogecoin is vulnerable to Information Disclosure. An attacker could exploit this vulnerability to steal a user's Bitcoin by obtaining their wallet.dat file. This could be done by causing the Bitcoin Core software to crash, and then extracting the wallet.dat file from the core dump file...

Malicious code in coinbase-wallet-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1892cfeefb3909aa3aed58c0112f2bc9fcb0a762f2242e57c991846a6b8bc875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...