Preface: The world’s first web-speed, internet-scale public blockchain. At the virtual event launching Sodium on September 30, 2022, the DFINITY Foundation will launch the Network Nervous System, an open algorithmic governance system that controlling the Internet computer. The event will also showcase in-depth technical material on advanced cryptography, consensus protocols, and token economics.

Background: Inter–canister calls can be used to update information between two or more canisters.

ic-cdk : Inter-canister calls for the ICRC-1 ledger.

ledger-icrc-js : A library for interfacing with ICRC-1 ledger on the Internet Computer.

When you deploy the WebAssembly module that contains your program on the Internet Computer blockchain, the program is executed inside a conceptual computational unit called a canister. Canisters can be developed in various programming languages.

With respect to update calls, canisters are “software actors” and may only contain a single thread of execution at any time, obviating the need for concurrency primitives such as mutexes. However, when update calls block on cross-canister calls to other canisters, other update calls can be started or continued, allowing for interleaving.

Ref: In most cases, you use dfx canister subcommands after you compile a program to manage the canister lifecycle and to perform key tasks such as calling program functions. The basic syntax for running dfx canister commands is: dfx canister <subcommand> [options]

Vulnerability details: When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture allows multiple references to be held for this internal state and not all references were dropped before the Future is resolved. Since we have unaccounted references held, a copy of the internal state ended up being persisted in the canister’s heap and thus causing a memory leak. Impact Canisters built in Rust with ic_cdk and ic_cdk_timers are affected. If these canisters call a canister method, use timers or heartbeat, they will likely leak a small amount of memory on every such operation. In the worst case, this could lead to heap memory exhaustion triggered by an attacker.

Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2024-7884

Preface: As of 4th Aug, 2021. There are 8106 unique holders of Lancer Token now on total amount 151 377 339,14 LNC.

Background: One of the most significant Ethereum tokens is known as ERC-20. ERC-20 tokens are issued on the Ethereum network. As of October 2019, more than 200,000 ERC-20-compatible tokens exist on Ethereum’s main network.

Vulnerability Details: An integer overflow in the transfer function of a smart contract implementation for Lancer Token, an Ethereum ERC20 token, allows the owner to cause unexpected financial losses between two large accounts during a transaction.

Reference: The attacker was able to pass a combination of input values that generate large results than the maximum value of uint256 data type can hold. It caused integer overflow and only the least significant bits have been retained. In other words, the uint256 variable reached to the maximum value that can be held and it wraps around by starting from 0. For example, an uint8 (8-bit unsigned integer) can represent maximum value of 28−1=255 (0xff). Multiplying 0x02 by 0x80 causes integer overflow and produces 0x00 as the result (0x02 * 0x80 = 0x100 => 0x00).

Reference article: Please refer to the following link – https://nvd.nist.gov/vuln/detail/CVE-2021-33403

Preface: In 2020, the public doubts that Bitcoin may die. The fact is, his performance is strong.

Background: Dumpwallet capable to dump all wallet keys in a human-readable format to a server-side file. When you use dumpwallet, you should expect to see several thousand lines. If you have not imported any scripts, you should have the same number of key lines as script lines.
This is because each key has a segwit script. SegWit is the process by which the block size limit on a blockchain is increased by removing signature data from bitcoin transactions. BIP173 is a way to encode segwit transaction outputs. If you have imported any scripts such as multisig scripts or addresses which are not yours, then you will see those scripts in the script lines as well.

Vulnerability details: Bitcoind is the Bitcoin Core daemon. A design weakness found on dumpwallet. The bitcoind in Bitcoin Core through 0.21.0 can create a new file in an arbitrary directory (e.g., outside the ~/.bitcoin directory) via a dumpwallet RPC call.

Impact: Arbitrary code execution is possible if file created. It increase the insider threats risk level.

Status: No official announcement has been received stating that the bug has been fixed. For more details, please refer to the link – https://github.com/bitcoin/bitcoin/issues/20866

An Integer Overflow is the condition that occurs when the result of an arithmetic operation, such as multiplication or addition, exceeds the maximum size of the integer type used to store it. Ethereum hits such vulnerability in frequent. The solidity programming language rescue Ethererum in the cryptocurrency world. But no prefect things in the world. A vulnerability found on Ethereum EUC token recently. The EUC token build by solidity programming language. The guru given his nick name “call abused” vulnerability. For details, please see below hyperlink for references.

Ethereum EUC Token (call abused) – CVE-2018-14087

https://github.com/rootclay/Audit-of-smart-contracts/tree/master/0x8810C63470d38639954c6B41AaC545848C46484a

Additional information – Ethereum integer overflow vulnerabilities

Ethereum aditus token (CV-2018-12959):

https://github.com/hellowuzekai/blockchains/blob/master/overflow2.md

Ethereum mkcb_token:

https://github.com/hellowuzekai/blockchains/blob/master/README.md

Ethereum singaporecoinorigin token:

https://github.com/hellowuzekai/blockchains/blob/master/overflow1.md

Ethereum stex white list token:

https://github.com/hellowuzekai/blockchains/blob/master/overflow3.md

Ethereum tracto token:

https://github.com/tracto2/Tracto-ERC20/issues/1

Ethereum virgo zodiactoken token:

https://github.com/hellowuzekai/blockchains/blob/master/transferFrom.md

Not belongs to integer overflow vulnerability:

Ethereum userwallet 0x0a7bca9fb7af-f26c6ed8029b-b6f0f5d291587c42 token:

https://github.com/hellowuzekai/blockchains/blob/master/delegatecall.md

Quote:
Attacker passes int greater than max (positive)
–> value wraps around to the min (negative!)

Can cause unexpected program behavior, possible buffer overflow exploits

The existing market cap of Ether (ETH) is more than Ripple and Litecoin, although it’s far behind Bitcoin (BTC). Ethereum contains potential market power. But integer overflow is the enemy of Ethereum. It is possible to scare the investor when related incident occurs.

What is the modulus in math?
Notice that the numbers on the clock go up to twelve, and then they start over.
In mathematics, this circular counting is called modular arithmetic, and the number 12 in this example is called a modulus.

Above theory bring  an idea that when modulus reach limit then it will reset to zero.

For instance, the owner of the smartcontract could set sellPrice and buyPrice using setPrices() function. For example, after some transactions, the owner could set sellPrice to 0x8000000000000000000000000000000000000000000000000000000000000000 (modulus). When some user wanted to sell 2 ETCBKs for ETHs back，amount * sellPrice equals 0. Thus the seller gave out 2 ETCBKs but none ETHs was retrieved. The contract still kept it, which makes this token unsafe. An overflow condition gives incorrect results and, particularly if the possibility has not been anticipated, can compromise a program’s reliability and security.

Theoretically, the programming language contain “Safe Math” can protect integer overflow/underflow won’t happen.

Below table of contents displayed the Integer overflow handling status in various programming languages.

This could happen whenever you are doing arithmetic operations such as + , – , * . When using the SafeMath library, the results of this operations will be checked and an error will be thrown stopping the execution of your smart contract.

Solidity can doing the magic

With Solidity feature, you can call the public functions defined by your library.  The SafeMath library to protect from inputs that could make your contract do unexpected things after overflow or underflow leading arithmetic operations.

Perhaps former cryptocurrency not used Solidity library and there it is possible let attacker conduct the integer overflow attacks. Below is the most update CVE status on Jul 2018.