Illuminate contest - 0xDjango's results

Lines of code

https://github.com/code-423n4/2022-06-illuminate/blob/912be2a90ded4a557f121fe565d12ec48d0c4684/lender/Lender.sol#L156-L159

Vulnerability details

Impact

Given the safety checks demonstrated in the Illuminate codebase to prevent against admin abilities to immediately withdraw user deposits, the vulnerability imposed by allowing the admin to set arbitrary approvals without timelock appears to be an oversight. For example, the Illuminate team has placed a 3 day timelock on direct admin withdrawals:

    /// @notice minimum amount of time the admin must wait before executing a withdrawl
    uint256 constant public HOLD = 3 days;

Though the admin is able to immediately set max approval for any token to any address. Therefore the admin can withdraw at any time.

    function approve(address[] calldata u, address[] calldata a) external authorized(admin) returns (bool) {
        uint256 len = u.length;
        if (len != a.length) {
            revert NotEqual('array length');
        }
        uint256 max = 2**256 - 1;


        for (uint256 i; i < len; ) {
            IERC20 uToken = IERC20(u[i]);
            if (address(0) != (address(uToken))) {
                Safe.approve(uToken, a[i], max);
            }
            unchecked {
                i++;
            }
        }
        return true;
    }

Tools Used

Manual review.

Recommended Mitigation Steps

Adding a similar admin timelock to the two approve() functions would mitigate this issue.

QA Report

[L-01] No ownership transfer pattern

https://github.com/code-423n4/2022-06-illuminate/blob/912be2a90ded4a557f121fe565d12ec48d0c4684/marketplace/MarketPlace.sol#L109-L112 https://github.com/code-423n4/2022-06-illuminate/blob/912be2a90ded4a557f121fe565d12ec48d0c4684/redeemer/Redeemer.sol#L62-L65

[L-02] Comment incorrectly describes function

The comment refers to the setFee() function instead of setSwivel().

https://github.com/code-423n4/2022-06-illuminate/blob/912be2a90ded4a557f121fe565d12ec48d0c4684/lender/Lender.sol#L153

[N-01] Typo in withdrawal

https://github.com/code-423n4/2022-06-illuminate/blob/912be2a90ded4a557f121fe565d12ec48d0c4684/lender/Lender.sol#L22