CVE-2021-3004

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-682

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3Exploit, Third Party Advisory
https://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261Third Party Advisory
https://blocksecteam.medium.com/deposit-less-get-more-ycredit-attack-details-f589f71674c3Exploit, Third Party Advisory
https://etherscan.io/address/0xe0839f9b9688a77924208ad509e29952dc660261Third Party Advisory

Timeline

Published: Jan 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-300425.4Cross Site Scripting (XSS) in Remote Clinic v2.0 via the "Clinic Name", "Clinic Address", "Clinic City", or "Clinic Contact" field on clinic CVE-2021-300445.4Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.CVE-2021-300459.1SerenityOS 2021-03-27 contains a buffer overflow vulnerability in the EndOfCentralDirectory::read() function.CVE-2021-300466.5VIGRA Computer Vision Library Version-1-11-1 contains a segmentation fault vulnerability in the impex.hxx read_image_band() function, in whi CVE-2021-300477.5VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed.CVE-2021-300485.3Directory Traversal in the fileDownload function in com/java2nb/common/controller/FileController.java in Novel-plus (小说精品屋-plus) 3.5.1 allow CVE-2021-300496.1SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.CVE-2021-30054.3MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice n CVE-2021-300558.8A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par_year'CVE-2021-300565.4Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in /restful-serv CVE-2021-300574.8A stored HTML injection vulnerability exists in Knowage Suite version 7.1. An attacker can inject arbitrary HTML in "/restful-services/2.0/a CVE-2021-300586.1Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). An attacker can inject arbitrary external script in '/knowagecockpiten