Knowledge Base
A technical encyclopedia of security vulnerabilities
Each article explains a vulnerability from first principles — definition, root cause, how the attack works, vulnerable and corrected examples, impact, detection, mitigation and verification — and states plainly how ROOTVIEL handles it, with an honest support level. Nothing is attributed to the platform that its detectors do not actually support.
// support levels: verified · partial · heuristic · hypothesis · educational
“Verified” means a deterministic verifier settled a specific property under stated assumptions — not that the system is secure. Its evidence scope is shown next to it: ◇ structural property (checked over a static graph — no exploit run) or ▶ observed in execution (an effect reproduced in a sandbox). Absence of findings is never proof of absence of vulnerabilities.
Domain · 10
AI, LLM & agents
A language model has no boundary between instructions and data, so any text it reads can steer it. This domain covers prompt injection (direct and indirect), jailbreaks, system-prompt and data leakage, and how adding tools, memory and autonomy turns a prompt-level trick into a real-world action.
Excessive Agency
An LLM-based system is granted more capability, permission, or autonomy than its purpose requires, so when any upstream failure (an injection, a hallucination, a bad decision) occurs, the agent can turn it into a consequential action far beyond what the task ever needed.
Insecure Output Handling
A system passes model output into a privileged sink — a shell, a query, a browser, a downstream API — without validating or encoding it first, so the model’s text is trusted as if a human had vetted it and becomes the payload for a classic injection in the consuming component.
Jailbreak
A jailbreak is an input crafted to defeat a model’s safety alignment, coercing it into producing content or behaviour its training was meant to refuse — a robustness failure of the defence, not a bug in any line of application code.
Memory Poisoning
An attacker writes attacker-controlled content into an agent’s persistent memory so that it is reloaded on a later turn — or a later session — and steers the agent toward a privileged action. The payload and its effect are separated in time, which is what makes it insidious.
Model Denial of Service
An attacker drives an LLM system to consume resources far out of proportion to a single request — through long inputs, expensive generation, or recursive agent loops — degrading service or inflating cost, because no budget bounds how much a single request may consume.
Direct Prompt Injection
An attacker places adversarial instructions directly in the user message to override the system prompt, extract hidden context, or coerce the model into behaviour its operator never intended — the canonical failure of treating a single token stream as both instructions and data.
Indirect Prompt Injection
An attacker hides instructions inside content the system will retrieve later — a document, a web page, a tool result — so the payload executes when some other user’s query pulls that content into the model’s context.
RAG Poisoning
An attacker writes malicious content into the knowledge base a Retrieval-Augmented Generation system indexes, so that when a legitimate query retrieves it, the planted text enters the model’s context and steers its answer or its actions.
Retrieval Manipulation
A retrieval layer returns content that either reaches a privileged tool it should never reach, or is not scoped to the identity of the caller — so retrieved data crosses an authorization boundary the system failed to enforce.
System Prompt Leakage
An attacker coerces the model into revealing its system prompt — the hidden instructions, context, and sometimes secrets the operator placed there — turning the prompt from a private configuration into disclosed information an adversary can study and exploit.
Domain · 9
Agentic architecture
When an LLM plans and calls tools, security becomes a question of authority: what the system is allowed to do, regardless of what the model decides. Here: delegation and the confused deputy, capability and privilege escalation, cross-agent trust, the lethal trifecta, and why enforcement must be deterministic and live outside the model.
Agent Collusion
Several agents, each individually within its permitted bounds, combine their capabilities through the channels that connect them to reach an outcome no single agent was allowed to reach. The danger is emergent — it lives in the composition, not in any one agent.
Confused Deputy
An agent holds privileges and credentials of its own, and acts on attacker-supplied input. When it uses a token outside the audience or scope it was granted — or follows an attacker-chosen URL into cloud credentials — it becomes a deputy tricked into wielding authority it holds but the attacker does not.
Cross-Agent Prompt Injection
In a multi-agent system, a prompt injection that lands in one agent propagates to another — because one agent’s output is another agent’s input, or because supposedly isolated agents share a writable channel. A single infection becomes a cascade.
Data Exfiltration (the Lethal Trifecta)
When one agent can read private data, is exposed to untrusted input, and can egress to the outside world — all three at once — an injected instruction can turn the agent into an exfiltration channel. The three legs together are what make it lethal.
Insecure Agent Delegation
When one agent hands work to another, authority is supposed to narrow, identity is supposed to attenuate, depth is supposed to be bounded, and delegation must not loop. When any of these fails, a sub-agent ends up with more power — or a deeper, cyclic, runaway chain — than the original grant ever intended.
MCP Rug Pull (Tool Drift)
An MCP tool is benign when an operator reviews and approves it, then changes afterwards — its description, schema, or behaviour drifts to something malicious on a later fetch. The approval was for a version that no longer runs; trust granted once is silently inherited by a different tool.
MCP Tool Poisoning
A Model Context Protocol server advertises a tool whose name, description, or parameter documentation carries hidden instructions. Because the agent reads that declared metadata into the same context it reasons over, the tool definition itself becomes a prompt-injection vector — before the tool is ever called.
Privilege Escalation Through Agents
An agent ends up exercising authority it was never granted. Comparing three views of its power — what it effectively has, what it actually uses, and what was declared to it — exposes the gap: authority in use or in reach that no grant ever authorized.
Tool Output Injection
A tool returns attacker-influenced content, and that content flows into a security-relevant decision — a policy check, an approval, a branch that grants access. The agent trusts a tool result as if it were a trusted fact, so untrusted output steers a decision it should never touch.
Domain · 25
Web3 & smart contracts
On-chain code is public, immutable and holds value, so a mistake is exploitable forever. This domain maps how protocols actually get broken — reentrancy, oracle and economic manipulation, access control, upgrade/proxy and cross-chain flaws — and treats a finding as proven only when the attack is executed in a sandbox and a deterministic check confirms it.
Broken Access Control & Authority
A privileged capability — ownership, an admin function, a fund movement — is reachable by someone who was never granted the authority to use it, whether through a missing modifier, an initializer that can be called again, or logic that moves value without checking either authority or entitlement.
Accounting / Vault Share Inflation
A vault derives each depositor’s shares from the ratio of total assets to total shares, and an attacker manipulates that ratio while it is fragile — classically as the first depositor into an empty vault — so later depositors’ shares round down to a value far below what they paid, and the attacker redeems the difference.
Bridge Authorization Failures
A cross-chain bridge accepts an instruction it should not: a forged or inauthentic message passes verification, a validator quorum is manipulated or under-sized, or the destination acts on source state that is not yet final and can be reorganized away.
Cross-Chain Message Replay
A cross-chain message that was meant to execute exactly once on the destination is accepted and executed more than once — because the destination does not bind each message to a unique, consumed identity (per-message nonce) and to the correct source and chain.
Cross-Function Reentrancy
During an external call, control re-enters the contract through a different function that shares state with the one still executing. A guard or CEI check applied to only one entrypoint is bypassed because the attacker never re-enters the same function — they enter its sibling.
Delegatecall Misuse
delegatecall runs another contract’s code against the caller’s own storage, balance, and identity. If the target address, or the code at it, is attacker-influenced, the attacker’s logic writes the caller’s storage — overwriting owners, pointers, or any slot — and acts as the caller.
Denial of Service & Gas Exhaustion
A required operation becomes uncallable: an unbounded loop grows past the block gas limit, a single reverting recipient blocks a whole batch, or a griefer forces a critical path to consume so much gas it can never complete. The harm is unavailability — not, by itself, a loss of funds.
Token Callback Reentrancy (ERC-721/1155)
Safe-transfer and safe-mint in ERC-721 and ERC-1155 call a hook on the recipient (onERC721Received / onERC1155Received) before the operation’s bookkeeping is complete. A recipient contract uses that hook to re-enter and mint, claim, or buy again while a per-address counter or supply check is still stale.
Token Semantics: Fee-on-Transfer, Rebasing & Return Values
Protocols that trust the amount they requested to transfer — instead of measuring the balance actually received — and that assume every ERC-20 behaves canonically, break against fee-on-transfer and rebasing tokens, non-standard return values, and the approve/transferFrom race.
Flash-Loan-Assisted Attacks
A flash loan lends an enormous, uncollateralised sum for the duration of a single transaction, on the sole condition that it is repaid before the transaction ends. It is not itself a bug — it is an amplifier that lets anyone wield whale-sized capital for one atomic block of logic, turning a latent flaw (a spot-price oracle, a weak vault invariant, a snapshot-based vote) into a profitable, capital-free exploit.
Governance Attacks
On-chain governance lets token holders propose and enact changes to a protocol — often including control of its treasury and its own upgradeable code. An attack converts temporary or illegitimate voting power into a permanent, privileged action: borrowing a voting majority for one block, passing a malicious proposal, bypassing a timelock, or exploiting weak quorum, delegation, or proposal-execution checks to seize what the vote was meant to protect.
Integer Overflow & Underflow
EVM integers are fixed-width and modular: an arithmetic result that falls outside a type’s range wraps around instead of erroring. Before Solidity 0.8 every operation wrapped silently; from 0.8 on the compiler inserts checks, but unchecked{} blocks, narrowing casts, and inline-assembly arithmetic reopen the same door — a wrapped value can mint balance, zero out accounting, or bypass a bound.
Lending & Liquidation Logic Failures
A lending protocol holds a simple invariant: every borrow must stay backed by collateral worth more than the debt, and when it slips, liquidation must restore solvency. Failures arise when collateral is mis-valued, interest accrual outruns the backing, or the liquidation path itself is wrong — leaving positions that cannot be liquidated, that over-liquidate the borrower, or that let bad debt accumulate until the protocol is insolvent.
Oracle & Price Manipulation
A protocol trusts a price it reads from a manipulable source — typically an AMM’s instantaneous spot reserves — so an attacker distorts that source within a single transaction (often with a flash loan), trades against the protocol at the wrong price, and walks away with more than they put in.
Precision Loss & Rounding Errors
The EVM has no floating point and no fractions: every division truncates toward zero. Order of operations, the direction a contract rounds, and tiny residues that accumulate over many calls can all shift value to whichever party the rounding favours — usually the attacker. The result is wrong but in-range, so overflow checks never fire.
Protocol Logic & State Violations
A protocol permits an action from a state that its own rules should forbid — a withdrawal while locked, a redeem before maturity, a claim before eligibility — often only reachable through a specific sequence of steps.
Proxy & Upgrade (Code Authority)
An upgradeable contract delegates its logic to an implementation whose address can be changed; if the authority to change that address is weak, or if an upgrade shifts the storage layout, an attacker can make the proxy run arbitrary code or silently corrupt every stored value — the question is literally "who controls the code this contract executes".
Read-Only Reentrancy
A view function returns a stale or self-inconsistent value while the contract is mid-reentrancy. The function itself changes nothing, so a classic reentrancy guard on state-changing paths never trips — but an integrating protocol reads that lying value and makes a real decision on it.
Reentrancy
A contract makes an external call before it finishes updating its own state, so the callee can call back into the contract mid-execution and act on stale values — classically draining a vault by withdrawing repeatedly before any balance is zeroed.
Sandwich Attacks & MEV
Transactions are public in the mempool before they confirm, and whoever orders a block chooses their sequence. MEV — Maximal Extractable Value — is the profit available from that ordering power. A sandwich attack is its signature form: a searcher front-runs a victim’s swap to move the price against them, lets the victim execute at the worse price, then back-runs to sell. The enabling flaw on the contract side is weak slippage protection.
ECDSA Verification & Signature Malleability
ECDSA signatures on Ethereum are malleable — for a valid (r,s,v) there is a second valid (r, n−s, v′) — and ecrecover returns address(0) for bad input; verification code that ignores these facts, or that signs without domain separation and a nonce, can be bypassed or replayed.
Signature Replay & Authorization
A contract accepts an off-chain signature as authorization but fails to bind it to a single use, a single contract/chain, or the right signer — so a valid signature can be replayed: submitted again, reused on another contract or chain, or accepted from the wrong recovered address.
Proxy Storage Collisions
An upgradeable proxy and its implementation contract disagree about what lives at a given storage slot, so a write meant for one variable silently overwrites another — corrupting ownership, balances, or the implementation address itself — most often after an upgrade changes the layout.
Unchecked External Calls
A low-level call, send, or an external interaction whose success boolean (or revert) is ignored. The call silently fails, execution continues as if it succeeded, and the contract’s accounting diverges from reality — recording a payout that never happened.
Uninitialized / Re-initializable Proxy
Upgradeable contracts replace constructors with an initializer function; if that function is not protected against repeated or late invocation, anyone can call it to become owner, set critical parameters, or seize an implementation contract left uninitialized behind a proxy.
Domain · 7
Application & code
The classic application weaknesses — injection, deserialization, SSRF, broken access control, secrets and supply chain — reasoned about as real, reachable dataflows from an untrusted source to a dangerous sink, not as isolated pattern matches.
Hardcoded Secrets
A credential — an API key, password, token, or private key — is embedded directly in source code, configuration, or build artifacts, so anyone who reads the code or a leaked copy of it obtains a working secret that is hard to rotate and easy to miss.
Insecure Deserialization
An application reconstructs objects from untrusted serialized data using a deserializer that can instantiate arbitrary types and run code during reconstruction, so a crafted payload drives the program’s own classes into a malicious computation — often remote code execution.
OS Command Injection
An application builds a system shell command from untrusted input and hands it to a shell, so shell metacharacters in the input are interpreted as syntax — letting the attacker run arbitrary commands with the privileges of the application process.
Path Traversal
An application builds a filesystem path from untrusted input without restricting it to an intended directory, so traversal sequences let the attacker read or write files outside that directory — configuration, secrets, source code, or arbitrary locations on the host.
Server-Side Request Forgery (SSRF)
An application makes an outbound request to a URL it takes from untrusted input, so the attacker aims the server’s own network position at internal services, cloud metadata, or arbitrary hosts — reaching resources a direct external request never could.
SQL Injection
An application builds a SQL statement by concatenating untrusted input into the query string, so the data crosses into the command and the attacker rewrites the query — reading, modifying, or destroying data the application never intended to expose.
XML External Entity (XXE)
An XML parser processes untrusted documents with external entity resolution enabled, so a crafted DOCTYPE declaration makes the parser fetch local files or network resources — leaking files, forging server-side requests, or exhausting resources.
Domain · 6
Infrastructure & systems
Container, cloud/IaC, host, network, TLS and runtime exposure, where a single misconfiguration matters because of the attack path it opens — for example what an over-permissioned role or an exposed service actually enables downstream.
Container Escape
A process inside a container breaks the isolation boundary and gains code execution on the host — because the container ran with excess kernel capabilities, a shared namespace, a sensitive host mount, or a vulnerable runtime, turning containment into a thin, bypassable fence rather than a trust boundary.
Exposed Management Service
An administrative interface, database, dashboard or management API is reachable from an untrusted network — often the public internet — when it should have been confined to an internal network or a bastion, so attackers can reach a high-value control surface directly and attack its authentication at will.
IaC & Cloud Misconfiguration
A cloud resource is provisioned with an insecure default or an overly open setting — a public storage bucket, a security group open to the whole internet, encryption or logging left off — usually baked into infrastructure-as-code, so the mistake is deployed consistently and at scale instead of being a one-off slip.
Insecure TLS Configuration
A service negotiates TLS with obsolete protocol versions, weak cipher suites, or without properly validating the peer’s certificate — so the confidentiality, integrity or authentication TLS is supposed to guarantee is undermined, leaving traffic open to decryption or a machine-in-the-middle.
Over-privileged IAM Role
A cloud identity — a role, user or service account — is granted far more permission than its job requires, often through wildcard actions or resources, so a single compromise of that identity becomes broad account access and any mistake it makes has an outsized blast radius.
Privileged Container
A container is run with privileged mode or broad added capabilities, so the process inside holds most of the host kernel’s authority — turning an ordinary workload compromise into host-level control, because the isolation that a container normally provides was switched off at launch.
Foundations
Concepts behind the work
Deeper background that the vulnerability articles build on.