AbstractRewardMine - Re-entrancy attack during withdrawal

Handle ScopeLift Vulnerability details Impact The internal withdraw method does not follow the checks-effects-interactions pattern. A malicious token, or one that implemented transfer hooks, could re-enter the public calling function such as withdraw before proper internal accounting was complete...

MiningService _withdrawMultiple will fail most of the times

Handle hyh Vulnerability details Impact Impact depends on subtraction overflow handling and this way on the compiler version used for production deployment. If compiler version above 0.8: The compiler will check subtraction and fail, so: a user will have all withdrawals failed most of the times,...

Key buyers will not be able to get refund if lock manager withdraws profits

Handle kenzo Vulnerability details Unlock contains a feature in which a key buyer can ask for a refund. The refund is sent from the lock - where the purchase funds were sent. The lock manager can withdraw all funds from the lock. Therefore, if the lock manager withdraws enough profits from the...

Fee double counting for underwater positions

Handle hyh Vulnerability details Impact Actual available fees are less than recorded. That's because a part of them corresponds to underwater positions, and will not have the correct amount stored with the contract: when calculation happens the fee is recorded first, then there is a check for...

YaxisVaultAdapter.sol#withdraw() will most certainly fail

Handle WatchPug Vulnerability details The actual token withdrawn from vault.withdraw will most certainly less than the amount, due to precision loss in tokensToShares and vault.withdraw. As a result, IDetailedERC20token.safeTransferrecipient, amount will revert due to insufficant balance. Based o...

Mixing different types of LP shares can lead to losses for Synth holders

Handle hyh Vulnerability details Impact Users that mint Synths do not get pool shares, so exiting of normal LP can lead to their losses as no funds can be left for retrieval. Proof of Concept 3 types of mint/burn: NFT, Fungible and Synths. Synths are most vilnerable as they do not have share: LP...

_vestLock contract is not approved to transfer mainToken from PublicSale.sol contract

Handle WatchPug Vulnerability details At L225 in processWithdrawal, it calls vestLock.vest to vest 70% of the tokens bought. However, PublicSale.sol contract never approve mainToken to the vestLock contract, making processWithdrawal to revet at L225. As a result, all the withdrawals will fail and...

CVE-2021-24835

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivendor plugin such as WCFM - WooCommerce Multivendor Marketplace, does not escape the withdrawalvendor...

WordPress SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. SQL injection vulnerability exists in the Wordpress...

MochiTreasuryV0.withdrawLock() Is Callable When Locking Has Been Toggled

Handle leastwood Vulnerability details Impact withdrawLock does not prevent users from calling this function when locking has been toggled. As a result, withdraws may be made unexpectedly. Proof of Concept Tools Used Manual code review Recommended Mitigation Steps Consider adding requirelockCrv,...

Anyone can extend withdraw wait period by depositing zero collateral

Handle harleythedog Vulnerability details Impact In MochiVault.sol, the deposit function allows anyone to deposit collateral into any position. A malicious user can call this function with amount = 0, which would reset the amount of time the owner has to wait before they can withdraw their...

User Fund loss in case of Unsupported Market token deposit

Handle csanuragjain Vulnerability details Impact User funds can be lost as current logic cannot withdraw unsupported market token even though deposit can be done for same Proof of Concept 1. Navigate to 2. Check the function deposit function depositaddress token, uint256 amount external override...

编号撤回

This CVE number has been withdrawn...

Withdrawing bounties after checking balances can lead to the entire basket being drained.

Handle itsmeSTYJ Vulnerability details Impact All funds in the basket can be stolen. Proof of Concept 1. Malicious user creates a smart contract that can interact w/ the auction can call bondForRebalance and settleAuction. 2. Auction is started by the publisher 3. Malicious user uses smart contra...

Vault does not normalize decimal on withdrawing

Handle jonah1005 Vulnerability details Impact The vault does not normalize decimals when a user withdraws the token. When a user has 100e18 shares, he can withdraw all usdc/ usdt from the token. The liquidity of USDC/USDC would be drained. I consider this is a high-risk issue. Proof of Concept...

User may receive less than the eligible amount per the shares being withdrawn

Handle 0xRajeev Vulnerability details Impact User may receive less than the eligible amount per the shares being withdrawn. It is not clear under what conditions this happens but needs to be documented and user warned. Proof of Concept Tools Used Manual Analysis Recommended Mitigation Steps...

Last person to withdraw his tokens might not be able to do this, in Crowdsale (edge case)

Handle gpersoon Vulnerability details Impact Suppose a Crowdsale is successful and enough commitments are made before the marketInfo.endTime. Suppose marketStatus.commitmentsTotal == marketInfo.totalTokens -1 // note this is an edge case, but can be constructed by an attacker Then the function...

Vault: Withdrawal amount isn't un-normalized

Handle hickuphh3 Vulnerability details Impact In withdraw, the withdrawal amount is the proportion of the normalized amounts of all the tokens in the vault and its strategies. However, this amount isn't un-normalized to the output token's decimals, thus leading to an erroneous token amount being...

Controller.withdraw(...) User may lose funds when withdraw wantToken from the underlying contract

Handle WatchPug Vulnerability details The wantToken of the strategy may be different from the token argument of Controller.withdrawaddress token, uint256 amount according to code at line 469-474 of Controller.sol. if want != token address converter = vaultDetailsmsg.sender.converter;...

Vault may not have enough tokens for withdraw

Handle 0xRajeev Vulnerability details Impact There is an assumption in LegacyController.vault that the vault will have enough tokens0 to cover the balance difference. If not, the user may receive less than amount requested and balance funds get lost/locked unless the vault withdraws from the...