PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pandora NFT: BugFix Review

hackenproof.com | blog | #web3 | #vulnerability-research | #defi | #smart-contract | #vulnerability-disclosure | #bugfix | #bsc | #defi-security | #nft
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A bugfix review of Pandora NFT's BondRouter: duplicate NFT Security IDs passed to harvest let an attacker reuse one bond to inflate interest payouts; lastHarvest is now updated per loop iteration.
Published
Collected

Related coverage

blog · hackenproof.com
Sui Move Smart Contract Security: How Shared Objects Leak and Ownership Breaks
Sui’s VM protects owned objects, not shared ones. See how shared-object, Kiosk, and PTB bugs break protocols, plus a full Sui Move audit checklist.
blog · hackenproof.com
Smart Contract Security in 2026: Risks, Best Practices, and Audits
Top smart contract security risks in 2026, best practices that prevent exploits, and when to audit your contracts. A practical guide for founders and CTOs.
blog · hackenproof.com
1inch Bug Bounty Report: Aqua Edition, H1 2026
This report highlights common smart contract and DeFi logic vulnerabilities discovered through crowdsourced security testing.
blog · hackenproof.com
The Oracle Connection: Preventing and Mitigating Oracle Attacks
An explainer on blockchain oracles: how input, output, cross-chain and compute-enabled oracles feed external data to smart contracts, and how to prevent and mitigate oracle attacks.
blog · hackenproof.com
DeFi Lending Protocols: Attack Vectors and How to Secure Them
How DeFi lending protocols work, the attack vectors behind recent exploits like Kelp-Aave and Tectonic, and the controls that keep lending markets secure.
blog · certik.com
Morpho Reached a New High While DeFi Remained Below Its Peak
Morpho surpassed its previous TVL high while DeFi remained below its 2025 peak, supported by growth across Robinhood Chain, Arc, and real-world asset lending.
Back