Malicious code in wbtc-address-set-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7a29f028b12bcfc56fb614b602c2a87e6aa9759e8cb9367ee05967ab3d8f696 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7053 Malicious code in wbtc-address-set-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7a29f028b12bcfc56fb614b602c2a87e6aa9759e8cb9367ee05967ab3d8f696 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Yield source does not correctly calculate share conversions

Lines of code Vulnerability details The aTokens’ value is pegged to the value of the corresponding supplied asset at a 1:1 ratio and can be safely stored, transferred or traded. All yield collected by the aTokens' reserves are distributed to aToken holders directly by continuously increasing thei...

Zap contract's redeem() function doesn't check which token the user wants to receive

Handle Ruhum Vulnerability details Impact In the redeem function, the user can pass a token address. That's the token they receive in return for the ibbtc they give back. Because of missing address checks the user can provide any possible ERC20 token here without the function reverting. Although...

IndexPool.mint The first liquidity provider is forced to supply assets in the same amount, which may cause a significant amount of fund loss

Handle WatchPug Vulnerability details When reserve == 0, amountIn for all the tokens will be set to the same amount: ratio, regardless of the weights, decimals and market prices of the assets. The first liquidity provider may not be aware of this so that it may create an arbitrage opportunity for...