Labs

An Anchor escrow vault program allows unauthorized emergency withdrawals because signer status is checked without authority equality validation.

A Rust support-ticket API reads records by ID without owner scoping, creating an IDOR access-control flaw.

A vendor escrow contract authorizes payouts with `tx.origin`, allowing malicious relay contracts to trigger owner-only actions.

A Hardhat tip-jar dApp lets creators withdraw funds, but state is updated after external calls, enabling reentrancy drain.

A Go analytics service exposes log download endpoints that concatenate user-controlled paths, enabling traversal outside the logs directory.

A PHP authentication service mixes legacy MD5 password storage with string-built SQL, enabling login bypass through injection.

A Spring Boot inventory lookup endpoint builds SQL from user input, allowing attacker-controlled query logic.

A Flask receipt renderer fetches user-provided URLs directly, enabling SSRF into internal and metadata endpoints.

A payments support API accepts raw JSON filter objects from users and passes them directly into query evaluation, enabling NoSQL injection.