leo princeleonal

Bug Description

There is a reentrancy vulnerability in TectonicStakingPoolV3.sol (https://cronoscan.com/address/0xE165132FdA537FA89Ca1B52A647240c2B84c8F89).

The issue arises due to the function performConversionForTokens() which is currently open for anyone to call because tcmPublicAccess is currently true. During a call to performConversionForTokens(), reentrancy can be achieved with the end result being the free minting of xTonic tokens. A brief description of the token conversion process:

The staking pool contract holds predominantly TONIC.
Other approved tokens held by the staking pool can be swapped for TONIC. For example, if the pool holds some WCRO, it can be swapped for TONIC using performConversionForTokens() which increases the contract's TONIC balance, thus increasing rewards for its stakers.
Upon successful conversion, any extra TONIC that was received during the swap (more than the oracle quote) is sent to the function caller as a reward.

The issue with the above is that a caller can

The Top Hacker Methodologies & Tools Notes

By Chase. ** *

Nuclei Templates

Concrete5 CMS : Identification, Mass Hunting, Nuclei Template Writing & Reporting

My Methodology

24x7x365 SUPPORT http://www.captiongenerator.com/320492/Offsec-Student-Admins

https://natesubra.com/go/oscp

OSCP Syllabus:

https://www.offensive-security.com/information-security-training/penetration-testing-training-kali-linux/

Windows Privilege Escalation:

http://www.fuzzysecurity.com/tutorials/16.html

What i'm using in streams and while working

Development tools

https://fishshell.com/ - my default shell, i use theme bobthefish
https://www.sublimetext.com/ - my default editor
- Material Theme
- Operator font
- Packages: Emmet, Hayaku, SidebarEnhancements, JS Snippets, GSAP Snippets
- Sublime snippet for comments
- Sublime icon
https://code.visualstudio.com/ - trying to switch, but not yet

How to pass the OSCP

Recon
Find vuln
Exploit
Document it

Recon

Unicornscans in cli, nmap in msfconsole to help store loot in database.

	#!/usr/bin/env zsh
	# Set up the default application for file types.
	# Strict mode: https://gist.github.com/vncsna/64825d5609c146e80de8b1fd623011ca
	set -euo pipefail

	# grab Cursor's bundle-ID
	BUNDLE_ID=$(osascript -e 'id of app "Cursor"')

	# Extensions in alphabetical order
	EXTENSIONS=(

	# pragma version ~=0.4.1
	"""
	@title Historical Block Hashes Oracle
	@custom:contract-name block_hash_oracle
	@license GNU Affero General Public License v3.0 only
	@author pcaversaccio
	@notice The contract function `block_hash` can be used to access the
	historical block hashes beyond the default 256-block limit.
	We use the EIP-2935 (https://eips.ethereum.org/EIPS/eip-2935)
	history contract, which maintains a ring buffer of the last

	const fetchLatestBlock = () =>
	fetch(`https://blockchain.info/q/latesthash?cors=true`)
	.then(r => r.text());

	const fetchMerkleRootAndTransactions = block =>
	fetch(`https://blockchain.info/rawblock/${block}?cors=true`)
	.then(r => r.json())
	.then(d => [d.mrkl_root, d.tx.map(t => t.hash)]);

	const random = arr =>