SB2021010303 - Improper access control in Loopring (LRC)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021010303

SB2021010303 - Improper access control in Loopring (LRC)

Published: January 3, 2021

Security Bulletin ID SB2021010303
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper access control (CVE-ID: CVE-2020-35962) Exploited

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring (LRC), an Ethereum token, lacks access control for fee swapping and thus allows price manipulation.

Note, the vulnerability has been exploited in the wild in November 2020.


Remediation

Install update from vendor's website.

References