Mimo August 2022 contest - 8olidity's results

Lines of code

https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/libraries/BoringBatchable.sol#L36

Vulnerability details

Impact

Detect the use of delegatecall inside a loop in a payable function.

Proof of Concept

contracts\libraries\BoringBatchable.sol:
  36    function batch(bytes[] calldata calls, bool revertOnFail) external payable {
  37:     for (uint256 i = 0; i < calls.length; i++) {
  38        (bool success, bytes memory result) = address(this).delegatecall(calls[i]);

When calling bad the same msg.value amount will be accredited multiple times.

Tools Used

vscode

Recommended Mitigation Steps

Carefully check that the function called by delegatecall is not payable/doesn't use msg.value.

Lines of code

https://github.com/code-423n4/2022-08-mimo/blob/main/contracts/proxy/MIMOProxy.sol#L133

Vulnerability details

Impact

The lack of a contract existence check when executing transactions in MIMOProxy might lead to incorrectly assuming that external code was executed.

Proof of Concept

contracts\proxy\MIMOProxy.sol:
  132      for (uint256 i = 0; i < targets.length; i++) {
  133:       (bool success, bytes memory response) = targets[i].call(data[i]);
  134        if (!success) {

poc

describe("--- MIMOMulticall Integration Tests ---", () => {
  it("should be able to deposit", async () => {
    const { mimoProxy, wmatic, vaultsCore, vaultsDataProvider, owner } = await setup();
    const result = await mimoProxy.multicall(
      [wmatic.address, wmatic.address, vaultsCore.address,'0xxxxxx'],// 
      [
        wmatic.interface.encodeFunctionData("transferFrom", [owner.address, mimoProxy.address, DEPOSIT_AMOUNT]),
        wmatic.interface.encodeFunctionData("approve", [vaultsCore.address, DEPOSIT_AMOUNT]),
        vaultsCore.interface.encodeFunctionData("deposit", [wmatic.address, DEPOSIT_AMOUNT]),
        wmatic.interface.encodeFunctionData("approve", ['0xxxxx', DEPOSIT_AMOUNT]),
      ],
    );
    console.log(result);

The function does not check for token code existence. The Solidity documentation warns:

The low-level call, delegatecall and callcode will return success if the called account is non-existent, as part of the design of EVM. Existence must be checked prior to calling if desired.

Tools Used

vscode

Recommended Mitigation Steps