ERC20 Incorrect check on returnedAddress in permit() results in unlimited approval of zero address

Lines of code Vulnerability details Impact When creating ERC20.sol from Solmate, a require in permit was converted to a custom error incorrectly. It now reads: if recoveredAddress != address0 && recoveredAddress != owner revert Invalidmsg.sender, owner; So if the recoveredAddress is non-zero and...

Migration Module: After successful migration, ERC20 assets can be thrown away by anyone

Lines of code Vulnerability details Impact HIGH - Assets can be lost directly After proposal and proposed buyout is successful, anyone can transfer ERC20 asset in the vault to the zero address and the asset will be lost. Proof of Concept proof of concept: testAnyoneCanThrowERC20poc The proof of...

Missing zero address check for bribesProcessor

Upgraded from 45: Missing zero address check for bribesProcessor MyStrategy.sol:100 ///@dev Change the contract that handles bribes function setBribesProcessorIBribesProcessor newBribesProcessor external onlyGovernance; bribesProcessor = newBribesProcessor; The bribeProcessor is not set in the...

Functions in the BatchRequests contract revert for removed contract addresses

Lines of code Vulnerability details Impact Removing Yieldy contract addresses from the contracts array with BatchRequests.removeAddress replaces the contract address with a zero-address due to how delete works. Each function that loops over the contracts array or accesses an array item by index,...

The Oracle address settings for the PriceOracle.sol contract are not checked for ZERO Address, and will not do the expected work if the prophecy machine address is set to Zero address (which will be populated with 0 by default if not passed to the constructor).

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The getPrice function of the PriceOracle contract internally calls getPriceFromAdapters to get the price, but does not check that the adapters are not set to Zero Address, so when the address in the...

Upgraded Q -> M from 104 [1654442859269]

Judge has assessed an item in Issue 104 as Medium risk. The relevant finding follows: Check transfer receiver is not 0 to avoid burned money Transferring tokens to the zero address is usually prohibited to accidentally avoid "burning" tokens by sending them to an unrecoverable zero address. Code...

WithdrawTo() needs a zero address check for _to parameter

Lines of code Vulnerability details Impact The withdrawTo function in Booster.sol is missing a zero address check for to parameter. Tokens would be lost if to is zero address. Proof of Concept Tools Used Manual review Recommended Mitigation Steps User require to ensure to is not a zero address. -...

Can steal yVault deposits due to bad initial shares calculation

Lines of code Vulnerability details Impact The yVault.deposit function mints initial shares equal to the deposited amount. The deposit / withdraw functions also use the balance, which includes the contract balance token.balanceOfaddressthis, to compute the shares. It's possible to increase the...

Burning collateralContractAddress by mistake in closeLoan

Lines of code closeLoan; L116-216 Vulnerability details Impact ERC721 used as collateral could possibly never return to borrower. Proof of Concept No zero address check for sendCollateralTo might lead to sending ERC721 used as collateral to inexistent address. Use of transferFrom instead of...

Owner Can Stop Bridge All Functionality Only With One Change

Lines of code Vulnerability details Impact Owner can stop all bridge functionality with the changing cBridge contract address with the zero. The centralized structure can cause to pause all operations. Proof of Concept Tools Used Code Review Recommended Mitigation Steps It is recommended to place...

Missing receiver validation in withdrawFrom

Lines of code Vulnerability details Impact The FETH.withdrawFrom function does not validate its to parameter. Funds can be lost if to is the zero address. Similar issues have been judged as medium recently, see Sandclock M-15 / Github issue Recommended Mitigation Steps Check that to != 0. --- The...

No guard against zero address can possibly break functions with onlyOwner modifier

Handle jayjonah8 Vulnerability details Impact In XDEFIDistribution.sol the proposeOwnership function should check that the newOwner arg is not a zero address because one error can break every function in the contract that uses the onlyOwner modifier because if the owner is set to the zero address...

Signature check passes for maker=0 orders

Handle cmichel Vulnerability details It's possible to choose the zero address for the maker of an order. Then any signature will pass the validOrderHash check. Impact This doesn't lead to any serious issues as the zero address does not have any approvals set of its own. The transactions will fail...

Previously created markets can be overwritten

Handle 0xRajeev Vulnerability details Impact The createMarket function allows accidental overwriting of previously created markets for the same combination of underlying and maturity timestamp u, m because there is no zero-address check to see if a previously created market exists for that...

Card affiliate payouts are skipped if a single card does not have an affiliate

Handle cmichel Vulnerability details Vulnerability Details The Market.initialize function sets the cardAffiliateCut to zero if a single cardAffiliateAddresses is the zero address. for uint256 i = 0; i numberOfCards; i++ if cardAffiliateAddressesi == address0 cardAffiliateCut = 0; Impact Even if a...

DEBIAN-CVE-2020-26262

Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of 127.x.x.x. However, it was observed that when sending a CONNECT request with the XOR-PEER-ADDRESS value...

RTMPDump librtmp Remote Code Execution Vulnerability

RTMPDump is a toolkit for working with RTMP a network protocol used to transmit video and audio data over the Internet. librtmp is one of the libraries that supports the RTMP protocol. RTMPDump version 2.4 has a security vulnerability in the 'AMF3CDAddProp' function in the amf.c file in librtmp...

Linux kernel denial of service vulnerability (CNVD-2016-02787)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A denial of service vulnerability exists in the 'redirecttarget' function in the net/ipv4/netfilter/iptREDIRECT.c file in versions of Linux kernel prior to 2.6.0. A remote...

PT-2016-3458 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.0 Description: The issue allows remote attackers to cause a denial of service by sending packets to an interface with a 0.0.0.0 IP address. This is related to a NULL pointer dereference and OOPS in the...

qemu: slirp: NULL pointer deref in sosendto()

A NULL pointer dereference flaw was found in the way QEMU handled UDP packets with a source port and address of 0 when QEMU's user networking was in use. A local guest user could use this flaw to crash the guest...