Caviar contest - 0x52's results

A fully on-chain NFT AMM that allows you to trade every NFT in a collection.

General Information

Platform: Code4rena

Start Date: 12/12/2022

Pot Size: $36,500 USDC

Total HM: 8

Participants: 103

Period: 7 days

Judge: berndartmueller

Id: 193

League: ETH

Caviar

Findings Distribution

Researcher Performance

Rank: 92/103

Findings: 1

Award: $6.99

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

6.9881 USDC - $6.99

Labels

bug
3 (High Risk)
satisfactory
upgraded by judge
duplicate-442

External Links

Lines of code

https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L417-L428

Vulnerability details

Impact

First LP can steal funds from later LPs due to truncation

Proof of Concept

LP value manipulation allows the first LP to dramatically inflate the value of the LP compared to the underlying token. When later LPs add funds, they will lose value due to the truncation that occurs during the calculations. This is a well known phenomenon which is why in UniswapV2 a small amount of LP is permanently locked on first deposit.

In this protocol they opt to not mint the minimum liquidity, presumably so that all liquidity can be removed at some point and potentially all NFTs can be redeemed. Realistically this is optimistic and in practice any vault that is closed will have to be auction off in the end anyways.

Tools Used

Manual Review

Use the Uniswap V2 mitigation and permanently lock a minimum amount of liquidity when the first LP deposits.

#0 - c4-judge

2022-12-28T15:39:49Z

berndartmueller marked the issue as duplicate of #442

#1 - c4-judge

2023-01-10T09:18:39Z

berndartmueller changed the severity to 3 (High Risk)

#2 - c4-judge

2023-01-10T09:18:44Z

berndartmueller marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter