Dopex - Anirruth's results

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/main/contracts/perp-vault/PerpetualAtlanticVault.sol#L359-L360 https://github.com/code-423n4/2023-08-dopex/blob/main/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L201

Vulnerability details

Impact

The settle function can be griefed and always revert

Proof of Concept

The PerpetualAtlanticVault.sol contains settle function which uses subtractLoss from PerpetualAtlanticVaultLP.sol, the bug is in subtractloss function as it requires collateral.balanceOf(address(this)) == _totalCollateral - loss so anyone can forcefully send a small amount of collateral token and make the require revert.

Tools Used

VS Code

Recommended Mitigation Steps

Change to: collateral.balanceOf(address(this)) >= _totalCollateral - loss

Assessed type

Error

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/main/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L199-L205

Vulnerability details

Impact

subtractLoss will always revert

Proof of Concept

function subtractLoss(uint256 loss) public onlyPerpVault {
    require(
      collateral.balanceOf(address(this)) == _totalCollateral - loss,
      "Not enough collateral was sent out"
    );
    _totalCollateral -= loss;
}

the function requires that collateral.balanceOf(address(this)) == _totalCollateral - loss, this check can be reverted by sending the collateral token directly to the contract (for example self destruct set to this address) causing this check to be false. Due to this attack other contracts depending on this function can also revert

Tools Used

VS code

Recommended Mitigation Steps

change it to collateral.balanceOf(address(this)) >= _totalCollateral - loss

Assessed type

Error