ParaSpace contest - Big0XDev's results

Lines of code

https://github.com/code-423n4/2022-11-paraspace/blob/main/paraspace-core/contracts/ui/WPunkGateway.sol#L77

Vulnerability details

Impact

In order to supply a PUNK, PUNK owner has to offer their PUNK for sale to the WPunkGateway with 0ETH and then call supplyPunk. during this time, anyone can call supplyPunk which will supply the PUNK to ParaSpace as collateral for the exploiter.

Proof of Concept

1- PUNK owner calls offerPunkForSale on their PUNK 2- Exploiter front-run the PUNK owner and calls supplyPunk 3- PUNK will be deposited to WPUNK and WPUNK token will be sent to the exploiter at the beginning of the TX. 4- supplyERC721 which will supply the PUNK to ParaSpace as collateral for the exploiter.

Tools Used

Manual review

Recommended Mitigation Steps

Add a check to see if the msg.sender is the owner of the punk:

      function supplyPunk(
        DataTypes.ERC721SupplyParams[] calldata punkIndexes,
        address onBehalfOf,
        uint16 referralCode
    ) external nonReentrant {
        for (uint256 i = 0; i < punkIndexes.length; i++) {
            require(Punk.punkIndexToAddress(punkIndexes[i].tokenId) == msg.sender);

            Punk.buyPunk(punkIndexes[i].tokenId);
            Punk.transferPunk(proxy, punkIndexes[i].tokenId);
            // gatewayProxy is the sender of this function, not the original gateway
            WPunk.mint(punkIndexes[i].tokenId);
        }

        Pool.supplyERC721(
            address(WPunk),
            punkIndexes,
            onBehalfOf,
            referralCode
        );
    }