Immunefi Audit CompetitionsShardeum Core II
Reports by Severity
Critical
- 35696 - [BC - Critical] Specifically crafted penalty TX may cause total network shutdown.
- 35694 - [BC - Critical] Consensus can be bypassed by single validator node from transaction execution g
- 35601 - [BC - Critical] Consensus algorithm doesn't deduplicate votes, allowing a malicious validator t
- 35695 - [BC - Critical] validateTxnFields check for internal transactions can be bypassed
- 35531 - [BC - Critical] Absence of signature deduplication for receipt in the binary_repair_oos_account
- 35707 - [BC - Critical] Reusing old transaction receipt to rollback account balance
- 35839 - [BC - Critical] Slash avoidance: Ineffective controls on unstaking allow unstaking before takin
- 35526 - [BC - Critical] An attacker can change the account balance after the transaction has been proce
Insight
- 36029 - [BC - Insight] Node.js crash on counterMap overflow
- 36024 - [BC - Insight] Use of Vulnerable function results in prediction of archivers
- 35965 - [BC - Insight] Unverified Data in Safety Sync
- 35415 - [BC - Insight] [Informational] debugMiddleware query parameters can be partially modified by re
- 35641 - [BC - Insight] node p2p remote denial of service
- 35697 - [BC - Insight] [Informational] Code logic contains potential risk of full network shutdown
- 35710 - [BC - Insight] addressToPartition input is unsanitized, allowing to take whole network down
Reports by Type
Blockchain/DLT
- 36029 - [BC - Insight] Node.js crash on counterMap overflow
- 35696 - [BC - Critical] Specifically crafted penalty TX may cause total network shutdown.
- 35694 - [BC - Critical] Consensus can be bypassed by single validator node from transaction execution g
- 35601 - [BC - Critical] Consensus algorithm doesn't deduplicate votes, allowing a malicious validator t
- 35695 - [BC - Critical] validateTxnFields check for internal transactions can be bypassed
- 35531 - [BC - Critical] Absence of signature deduplication for receipt in the binary_repair_oos_account
- 36024 - [BC - Insight] Use of Vulnerable function results in prediction of archivers
- 35965 - [BC - Insight] Unverified Data in Safety Sync
- 35707 - [BC - Critical] Reusing old transaction receipt to rollback account balance
- 35415 - [BC - Insight] [Informational] debugMiddleware query parameters can be partially modified by re
- 35839 - [BC - Critical] Slash avoidance: Ineffective controls on unstaking allow unstaking before takin
- 35526 - [BC - Critical] An attacker can change the account balance after the transaction has been proce
- 35641 - [BC - Insight] node p2p remote denial of service
- 35697 - [BC - Insight] [Informational] Code logic contains potential risk of full network shutdown
- 35710 - [BC - Insight] addressToPartition input is unsanitized, allowing to take whole network down