Max withdrawable calculation is incorrect in asD contract

Lines of code Vulnerability details Summary The implementation of the max withdrawable amount is incorrect as it divides the calculation by the wrong denominator, leading to an incorrect result and a potential denial of service due to an overflow. Impact In the Application Specific Dollar protoco...

Cannot withdraw 1:1

Lines of code Vulnerability details function testX public uint256 mintAmount = 10e18; NOTE.mintalice, mintAmount; vm.startPrankalice; NOTE.approveaddressasdToken, mintAmount; asdToken.mintmintAmount; uint256 newExchangeRate = 1.1e28; cNOTE.setExchangeRatenewExchangeRate; vm.startPrankowner;...

Intrinsic arbitrage between assets due to price feed deviation threshold

Lines of code Vulnerability details Impact Withdrawals have not yet been implemented but I assume it will be implemented in the usual way such that the fraction of total supply of rsETH a user redeems gives him an equal fraction of total assets held, i.e. received = sharesToRedeem totalAssets /...

No way to withdraw from the strategy

Lines of code Vulnerability details Impact NodeDelegator does not have any functions to withdraw the underlying from the strategy. It does have a function to transfer ERC-20 tokens to the LRTDepositPool, assuming the eigen layer strategy mints ERC20 tokens to represent the share of invested funds...

User can not receive own assets back

Lines of code Vulnerability details Impact The user has the opportunity to deposit tokens, but does not have the opportunity to withdraw them back. Consequently, his tokens will be locked in the contract and he will not be able to take them back. Yes, the contract is upgradable - but this does no...

Funds cannot be withdrawn from EigenLayer

Lines of code Vulnerability details Impact NodeDelegator contracts handle depositing LSTs into EigenLayer to earn yield. However the contract lacks functions to withdraw those tokens afterwards, meaning they will become trapped in the EigenLayer protocol. This breaks the functionality of the...

Vulnerability in Token Withdrawal Function

Lines of code Vulnerability details Impact Flawed logic in token withdrawal function allows for selective withdrawal of high-value tokens and fails in single-token scenarios. // Sum up total amount of each token to withdraw. uint256 memory withdrawAmounts = new uint256; IERC20 prevToken; for...

Number withdrawn

Online Matrimonial Project is an online marriage recruitment program. This CVE number has been withdrawn...

paucheTranche state can be set to arbitrary value

Lines of code Vulnerability details Impact paucheTranche state can be set to arbitrary value Proof of Concept the protocol has this concept of tranche id and borrower tier, the higher borrower tier means high risk lower borrower tier means low risk but when liquidation happens if the...

Number withdrawn

Online Bus Booking System is an online bus booking system. This CVE number has been withdrawn...

Number withdrawn

Online Blood Bank Management System is an online blood bank management system. This CVE number has been withdrawn...

Number withdrawn

Online Blood Bank Management System is an online blood bank management system. This CVE number has been withdrawn...

GHSA-4FRV-5FJ6-4P25 Duplicate Advisory: NATS.io: Adding accounts for just the system account adds auth bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fr2g-9hjm-wr23. This link is maintained to preserve external references. Original Description NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an...

CVE-2023-39814

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2023-39817

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2023-39814

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2023-23767

Rejected reason: This CVE ID has been rejected or withdrawn by GitHub as it was issued in error...

M-05 Unmitigated

Lines of code Vulnerability details Original Issue M-05: Reward sandwiching in VotiumStrategy Details The issue outlined above is about making instant profit by depositing before the boost happens and withdrawing right after the boost occurs. Those who locked their positions for 16+ weeks get the...

[ADRIRO-NEW-H-01] VotiumStrategy withdrawal can still be executed with minimal delay

Lines of code Vulnerability details Summary Within the mitigation changes, the sponsor has introduced a minimum delay of one epoch for VotiumStrategy withdrawals, in order to mitigate different issues related to the exposure to CVX . The fix contains an edge case which could still be used to make...

M-05 Unmitigated

Lines of code Vulnerability details Mitigation of M-05: Mitigation Error, see comments Link to Issue: code-423n4/2023-09-asymmetry-findings45 Comments To mitigate M-05, the sponsor has added a delay of one epoch when the available CVX balance is enough to cover the withdrawal: 81: uint256...