Rubicon contest - 0x52's results

Lines of code

https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/contracts/rubiconPools/BathToken.sol#L629-L653

Vulnerability details

Impact

Vested rewards from BathBuddy can be stolen

Proof of Concept

Each time withdraw() is called the following lines are used to determine the reward for the given withdraw:

https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/contracts/rubiconPools/BathToken.sol#L642-L648

This means that if 10% of outstanding shares are withdrawn, then 10% of the vested rewards are also distributed. An attacker could deposit assets to obtain shares then immediately call withdraw to receive rewards from BathBuddy and their initial deposit back from BathToken. They can then deposit the same assets again and keep repeating the cycle until all vested rewards have been drained from BathBuddy.

Tools Used

Recommended Mitigation Steps

A mapping should be implement to track when a user deposited tokens and make vesting reliant on both the time and amount deposited

Lines of code

https://github.com/code-423n4/2022-05-rubicon/blob/8c312a63a91193c6a192a9aab44ff980fbfd7741/contracts/rubiconPools/BathPair.sol#L535-L563

Vulnerability details

Submitting as medium risk bug because it would have to be a whitelisted strategist

Impact

Malicious strategist can steal all user funds

Proof of Concept

TailOff allows strategist to specify both the minimum out and the contract responsible for swapping tokens. Malicious/compromised strategist can easily steal all user funds in contract by referencing malicious _stratUtil and 0 for the hurdle amount or by sandwich attack on legitimate _stratUtil and hurdle of 0

Tools Used

Recommended Mitigation Steps

Limit _stratUtil to whitelisted contract and implement a slippage limit