Dopex - 0xMosh's results

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/core/RdpxV2Core.sol#L1002

Vulnerability details

Impact

function sync() may get DOS'ed permanently .

Proof of Concept

In function addToDelegate , the totalWethDelegated varaible is used to track the amount of Weth delegated for bonding . However it is not decreased when Weth is withdrawed from the protocol .This is problamatic cause this may parmanently DOS the sync() function .

The sync() function is used to rebalance different token balances .. According to the protocol team " Its to sync the reserves in the core contract so if we have the AMO's perform market operations then anyone can call sync." It is an important function in the protocol . The function looks like this :

 function sync() external { //Syncs the different token ballances .. //@n but this is not called anywhere in the contract 
    for (uint256 i = 1; i < reserveAsset.length; i++) {
      uint256 balance = IERC20WithBurn(reserveAsset[i].tokenAddress).balanceOf(
        address(this)
      );

      if (weth == reserveAsset[i].tokenAddress) {
        balance = balance - totalWethDelegated; //<----- this will underflow and revert  if totalwethdelegated is larger than the balance and DOS the function everytie it's being called 
      }
      reserveAsset[i].tokenBalance = balance;
    }

    emit LogSync();
  }

Here , if the asset is Weth , then Weth balance of the contract is cached first , then totalWethDelegated is substracted from the cached balance and then reserveAsset[i].tokenBalance is updated.

The problem here is totalWethDelegated varaiable may get larger than the Weth balance of the contract . In that scenario , solidity 0.8.19 will revert the function call bacause of the underflow and reserveAsset[i].tokenBalance cannot be updated anymore which is crucial for the protocol to function properly .

Also , an attacker can maliciously call the addToDelegate function and withdraw function repeatedly with a good amount of weth to increase totalWethDelegated varaiable and exploit the given issue by just paying a small amount of gas fees .

Tools Used

Manual Review

Recommended Mitigation Steps

Mitigation is simple . Decrease the totalWethDelegated varaiable while withdrawing delegeated weth from the protocol to mitigate the issue .

Assessed type

DoS