Immunefi Audit Competitions

Shardeum Ancillaries II

Reports by Severity

Critical

36025 - [W&A - Critical] A malicious validator can overwrite the account data of any archive server con
35709 - [W&A - Critical] Potential DoS of archiver-server during network restoration via get_account_da

High

Medium

35824 - [W&A - Medium] /set-config replay attack is possible in production mode after archiver restar

Insight

Reports by Type

Websites and Applications

35598 - [W&A - Insight] Access to debug endpoints without any protection
35351 - [W&A - Insight] Password Length Bypass in Shardeum Authentication System
35537 - [W&A - Insight] json rpc server websocket remote crash
35996 - [W&A - Insight] Malicious Explorer can cause Denial of Service in JSON RPC server and even crash it
35979 - [W&A - High] Malicious Archiver/Malicious Validator can overwrite data on any active archiver and more
36025 - [W&A - Critical] A malicious validator can overwrite the account data of any archive server con
35452 - [W&A - High] Admin Panel Accessed
36005 - [W&A - Insight] Reflected URL Manipulation and Phishing Risk
35972 - [W&A - Insight] Operator-GUI Weak JWT Token Generation Led To Generate same JWT Tokens Even if
35447 - [W&A - High] Zero Click Full Account Takeover
35446 - [W&A - Insight] IDOR Able to change other user information
35903 - [W&A - High] SQL Injection Allows a Malicious Archiver to Overwrite Receipt/originalTxData Data
35824 - [W&A - Medium] /set-config replay attack is possible in production mode after archiver restar
35157 - [W&A - Insight] Unauthorized Access to Shardeum Config Store using default credentials
35709 - [W&A - Critical] Potential DoS of archiver-server during network restoration via get_account_da
35534 - [W&A - Insight] json rpc server remote crash