Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the fact that when using the cachefileswithdrawcookie function, the fscachevolume may have been released but...

Wrong invocation of Whirpools's updateFeesAndRewards will cause it to always revert

Lines of code Vulnerability details Impact Deposits will be unwithdrawable from the lockbox Proof of Concept If the entire liquidity of a position has been removed, the withdraw function calls the updateFeesAndRewards function on the Orca pool before attempting to close the position. function...

When the returnNative parameter is set to true in the _params provided to MoneyMarketHook.execute, it is not handled properly and could disrupt user expectations

Lines of code Vulnerability details Impact When param.returnNative is set to true while calling MoneyMarketHook.execute, users expect the returned token from the withdraw operation to be in native form and sent to the caller. However, in the current implementation, this is not considered and coul...

Funds are lost when Curve pool is killed (paused)

Lines of code Vulnerability details Vulnerability Details If self.iskilled in the curve pool contract becomes true, users will be unable to close their position because removeliquidityonecoinwill revert. Users will be unable to exit their position. if outputToken == zToken uint256 wethBalance =...

Upgraded Q -> 2 from #491 [1701115520323]

Judge has assessed an item in Issue 491 as 2 risk. The relevant finding follows: L-03 While StakedUSDeV2.cooldownDuration is changed from non-zero to zero, stakers should be able to call StakedUSDeV2.unstake to withdraw assets regardless of userCooldown.cooldownEnd File: While...

claimAuction can be reverted by any bidder, locking all funds and the prize.

Lines of code Vulnerability details Description claimAuction is used to redeem the auction's ERC-721 and refund all bidders that didn't win the auction. In this process, callbacks are sent to every single bidder via low-level calls that triggers fallbacks/receives and ERC721.safeTransferFrom. So,...

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed because the presence of EOR does not lead to a treat-as-withdraw outcome.

...

interest is still accuring when the market is paused, force user to incur debts

Lines of code Vulnerability details Impact interest is still accuring when the market is paused, force user to incur debts Proof of Concept when the function accure is called the interest is accured after the interest rate is calculated uint256 interestRate = IIRMirm.getInterestRateaddressthis,...

CVE-2023-47235

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of EOR does not lead to a treat-as-withdraw outcome...

tranche id check has off-by-one error

Lines of code Vulnerability details Impact tranche id check has off-by-one error Proof of Concept In TestOmniPool.t.sol, we add the following POC function testSetTrancheCountPOC public for uint256 i = 4; i 256; i++ pool.setTrancheCountaddressoToken, uint8i; oToken.deposit0, 255, 1 ether; we run t...

There is no check for collateral token in mint matches same in withdraw

Lines of code Vulnerability details Impact While we understand that usde is the base token here, we see that on minting used token you would need to transfer some tokens to the contract and get some used minted to you and on redemption get usde burnt to get a token sent back to you. The implicati...

Lender can cause unintended behavior for the borrower's transaction

Lines of code Vulnerability details This vulnerability comes in the form of when a borrower wants to remove a lender as a both deposit and withdraw and set them as a withdraw only, to avoid paying more interest on their funds in the market, this plan may not go as planned, based on the nature of...

[H-02] Mitigation error: Null Votium withdrawal requests are queued last

Lines of code Vulnerability details Description When a request to withdraw is placed such that VotiumStrategy.requestWithdraw0 is called, this queues it to the end of all previous withdrawal requests as if an infinitesimal amount is to be withdrawn, incurring an artificially prolonged withdrawal...

H-02 Unmitigated

Lines of code Vulnerability details Mitigation of H-02: Issue mitigated with ERROR Mitigated issue H-02: Zero amount withdrawals of SafEth or Votium will brick the withdraw process The issue was that withdrawing afEth might imply a withdrawal of 0 safEth or vAfEth, which reverts. Mitigation revie...

CVE-2023-5697

A vulnerability classified as problematic has been found in CodeAstro Internet Banking System 1.0. This affects an unknown part of the file pageswithdrawmoney.php. The manipulation of the argument accountnumber with the input 287359614--alert1234!-- leads to cross site scripting. It is possible t...

CodeAstro Internet Banking System Cross-Site Scripting Vulnerability

CodeAstro Internet Banking System is a PHP online banking system from CodeAstro. A cross-site scripting vulnerability exists in CodeAstro Internet Banking System version 1.0, which originates from a cross-site scripting XSS vulnerability in the parameter accountnumber in the file...

Withdrawals will be permanently DOSed if VLCVX's owner decides to shutdown the contract

Lines of code Vulnerability details Bug Description In VotiumStrategy.sol, the relock function is used to withdraw all unlockable CVX and then lock an appropriate amount of CVX again. It does so by calling lock of the VLCVX contract: VotiumStrategy.solL145-L148 if cvxAmountToRelock 0...

M-05 MitigationConfirmed

Lines of code Vulnerability details In the previous implementation when stakingContract.totalAllocPoint = 0 stakingContract.withdraw and stakingContract.deposit will div 0 , revert This results in StargateRewardableWrapper no longer being able to execute StargateRewardableWrapper.withdraw The...

Attacker can mint afEth with cheaper price

Lines of code Vulnerability details Impact Attacker can mint afEth with cheaper price and then withdraw. Proof of Concept When user would like to buy some amount of afEth tokens, then price is calculated. This price will be used to calculate amount of tokens to mint. function price public view...

VotiumStrategyCore.applyRewards can be sandwhiched to make profit

Lines of code Vulnerability details Impact VotiumStrategyCore.applyRewards can be sandwhiched to make profit. Proof of Concept VotiumStrategyCore.applyRewards function will swap all rewards of contract into eth and then stake them into safEth or vEth contract. As result price of afEth token will...