aurecoinfabrik/test2 huggingface dataset:
Security audit of Parallel by Slow Mist

Findings:

title: Need to upgrade the module
reported_impact: low-risk
description: 5.1 Need to upgrade the module [low-risk]
ID:RUSTSEC-2021-0067
Crate:cranelift-codegen
Version: 0.71.0
Date:2021-05-21
URL:https://rustsec.org/advisories/RUSTSEC-2021-0067
Title: Memory access due to code generation flaw in Cranelift module
Solution: upgrade to >= 0.73.1 OR >= 0.74
Dependency tree: cranelift-codegen 0.71.0
Fixed in: https://github.com/parallel-finance/parallel/pull/210

title: Numeric overflow
reported_impact: enhancement
description: 5.2 Numeric overflow[enhancement]
parallel/pallets/loans/src/lib.rs
let total_reserves_new = total_reserves - reduce_amount;
//...snip code...//
let total_reserves_new = total_reserves + add_amount;
It is recommended to use `checked_add/checked_sub` to prevent numerical overflow.
Fixed in: https://github.com/parallel-finance/parallel/pull/241

title: Lack of bounds checking
reported_impact: weakness
description: 5.3 Lack of bounds checking[weakness]
`mint_amount` has no boundary limit, it is recommended to enhance.
Fixed in: https://github.com/parallel-finance/parallel/pull/258

title: Oracle price feed risk
reported_impact: weakness
description: 5.4 Oracle price feed risk[weakness]
Due to the lack of time parameter, if the price is not feed in time, the price may be inaccurate.
parallel/pallets/prices/src/lib.rs
pub enum Event<T: Config> {
/// Set emergency price. [currency_id, price_detail]
SetPrice(CurrencyId, PriceWithDecimal),
/// Reset emergency price. [currency_id]
ResetPrice(CurrencyId),
}
Feedback: At present, the source of price feeding is controlled by authority and credible. The range of trustworthiness includes the accuracy and real-time of the price, that is, outdated prices will not be sent to the chain, but the price feeding transaction sent is through operational on the chain. Transaction level guarantees will be packaged in real time, that is, the current block.
Security audit of Astar by Security Research Labs

Findings:

title: Missing benchmarking for the lockdrop precompile dispatch
reported_impact: Info
description: 3.2.1 Missing benchmarking for the lockdrop precompile dispatch
Attack scenario
Location
Tracking
Attack impact
Severity
Status
Static ref_time used for weight calculation leading to underestimation
of the weights can enable an attacker to perform denial of service
precompiles/dispatch-lockdrop
[2]
An attacker may spam and conduct denial of service attacks cheaply in
comparison to the actual weight_to_gas price
Info
Closed [4]
The precompile dispatch-lockdrop has un-benchmarked weight_to_gas estimation with
ref_time configured to 1_000_000_000 [5].
// Record a fixed amount of weight to ensure there is no free execution
handle.record_cost(Runtime::GasWeightMapping::weight_to_gas(
    Weight::from_parts(1_000_000_000u64, 0),
))?;
This estimation doesn’t reflect the actual runtime environment and can aid an attacker to spam
the chain.
We suggest to appropriately benchmark the precompile dispatch to reflect the accurate
weight_to_gas estimation for ref_time and POV_size.
The issue was acknowledged by the Astar team and remediation is currently in progress
through collaboration with the Frontier team [6]

title: Unbounded call length limit in lockdrop dispatch call
reported_impact: Low
description: 3.2.2 Unbounded call length limit in lockdrop dispatch call
Attack scenario
Location
Tracking
Attack impact
Severity
Status
An attacker may create multiple nested calls bloating the call_length
before call decoding
precompiles/dispatch-lockdrop
[3]
Unbounded call length can aid an attacker to cause heap overflow when
call data is moved to the vector
Low
Closed [7]
The precompile dispatch call uses the UnboundedBytes [8] type without any call_length being
set for the call object parameter. During runtime-call decoding, a stack overflow is prevented
through usage of DecodeLimit [9] however, a heap overflow might occur even before decoding
if an unbounded call with large call_length is moved into the u8 vector.
An attacker can use this to create multiple nested calls bloating the call_length and cause heap
overflow even before call decoding.
We recommend using BoundedBytes<call_length> instead of UnboundedBytes. A best practice
implementation from Moonbeam may be adopted for setting CallLengthLimit similar to
GetProposalLimit [10] and implementing additional guard condition for call_length validity
similar to proposal_length [11] before decoding the call for additional safety.
Security audit of Astar by Zellic

Findings:

title: Weight calculation
reported_impact: Low
vulnerability_class_audit: Coding Mistakes
description: All the assets pallet functions exposed by the chain extension are weighted with a constant amount. The weight of some operations is charged using the same quantity that the assets pallet benchmarks have computed. However, other operations only charge the weight of one runtime database read operation — T::DbWeight::get().reads(1_u64).
Two functions, MetadataSymbol and MetadataName, operate on a variable amount of data, but they also only account for one runtime database read operation.