Immunefi Audit Competitions

Shardeum Core

Reports by Severity

Critical

32982 - [BC - Critical] Crashing all Validators Vulnerability in eth_g...
32993 - [BC - Critical] Crashing Validators by triggering an uncaught e...
33086 - [BC - Critical] Complete shutdown of the transaction processing...
33151 - [BC - Critical] Front running initial account data distribution
33222 - [BC - Critical] An attacker can control which nodes can and can...
33277 - [BC - Critical] Validators can be crashed via GET
33278 - [BC - Critical] Improper input validation leads to DOS and total network shutdown
33424 - [BC - Critical] Improper input validation in safeJsonParse leads to DOS and total network shutdown
33428 - [BC - Critical] Validators can be crashed via pp
33483 - [BC - Critical] shardeum validator bypass loop breaking increme...
33632 - [BC - Critical] Signature forgery on behalf of other nodes leads to network takeover
33637 - [BC - Critical] In " get_tx_timestamp " a prototype pollution bricks validators
33638 - [BC - Critical] In " remove_timestamp_cache " a prototype pollution bricks validators
33655 - [BC - Critical] Complete shutdown of the transaction processing...
33696 - [BC - Critical] Failure to validate golden ticket admin cert
33745 - [BC - Critical] A math quirk in Javascript allows anyone to take down any validator or the full network with an HTTP GET request.
33750 - [BC - Critical] Abusing setCertTime Transactions to drain node ...
33766 - [BC - Critical] Improper input validation in TransactionConsenu...
33872 - [BC - Critical] Infinite loop in shardeum
33922 - [BC - Critical] Steal Rewards and Take over Network by Faking A...
33925 - [BC - Critical] Improper input validation in fixDeserializedWrappedEVMAccount leads to DOS and total network shutdown
33941 - [BC - Critical] A missing check for the type of a variable allo...
33946 - [BC - Critical] Lack of voter deduplication in sync_trie_hashes...
33963 - [BC - Critical] Crashing the network by filling timestamp cache...
33972 - [BC - Critical] Inflating the votes of the hash for a malicious trie data structure to bypass the consensus system and modify account data
34012 - [BC - Critical] Improper input validation in repair_oos_accounts leads to DOS and total network shutdown
34019 - [BC - Critical] Lack of vote validation in sync_trie_hashes leads to total fund loss and tokenomics crash
34020 - [BC - Critical] An alternative entry point with a separated but vulnerable implementation allows to bypass the consensus system and modify account data
34053 - [BC - Critical] Malicious HTTP responses allow systemic application level denial-of-service attack against multiple Shardeum components
34093 - [BC - Critical] lib-net: can be used to force oom reap of shardus instances
34201 - [BC - Critical] Prototype pollution vulnerability in remove_tim...
34252 - [BC - Critical] Bypass Certificate Signing Validation
34353 - [BC - Critical] Killing nodes by polluting tx timestamp cache o...
34456 - [BC - Critical] Lack of consensus validation in repair_oos_accounts leads to total fund loss and tokenomics crash
34476 - [BC - Critical] remove_timestamp_cache prototype pollution lead...
34481 - [BC - Critical] Bypassing sender verification in gossip-final-s...
34484 - [BC - Critical] Tricking legit node to signed maliciously contr...
34500 - [BC - Critical] Prototype pollution vulnerability in get_tx_tim...

High

Medium

Low

32942 - [BC - Low] The ChainID and URL parameters that can modify ...

Insight

Reports by Type

Blockchain/DLT