DYAD - CaeraDenoir's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L205

Vulnerability details

Summary

There is a way to send tokens to another ID vault without being the owner of the token ID. This could seem harmless to the token ID owner (because you're essentially receiveng assets for free) but recieving assets while you're trying to delete a vault would make the transaction fail.

Vulnerability Details

When someone calls a liquidation, the assets are send to another ID. This could lead to users abusing the function to liquidate themselves with lower values, sending assets to any other ID. Normally this would cause no problem at all, because it is impossible to control when something is liquidatable or not, but due to the introduction of kerosene this is not longer impossible to control.

This is due to the value of kerosene depending on the amount of DYAD minted (the price being lower when more DYADS are in circulation).

A user with two ID's could deposit a lower value of assets in one ID, minting the most DYADS he can and then mint any amount on the second ID. This would cause the first ID to be able to be liquidated and making anyone who calls the function liquidate able to send the assets to any ID.

Impact

Even though it is a huge problem to deny removal of vaults to anyone, the idea behind it requires the malicious actor to hold 2 different DNFTs, minimizing the risk.

However, there are extreme cases where a user may try to remove a vault to add collateral to prevent being liquidated (assuming there is enough collateral in other vaults, but losing value), and denying the removal could cause some liquidations to be possible.

The extreme case is purely theory, but the denial of removals is available regardless. Due to this, the impact on the protocol would be medium.

Proof Of Concept

Alice wishes to send assets to a vault which Bob owns(holds the DNFT). She has 2 DNFTs.

Alice's first and second vaults have the same collateral, and the difference between them is each is linked to a different DNFT.

Bob's DNFT vault balance: 0

Alice's first DNFT vault balance: 0

Alice's second DNFT vault balance: 0

Alice realizes, she can liquidate herself to forcefully send funds.

First, she deposits some USDT (using USDT as an example) on both her accounts.

Bob's DNFT vault balance: 0

Alice's first DNFT vault balance: 1 USDT

Alice's second DNFT vault balance: 100 USDT

Alice wants to send 1 USDT to bob, so she tries to make the first vault get liquidated. To do this, she deposits 0.5 USD in kerosene in the DNFT from the first vault, and mints 1 DYAD USD.

Bob's vault balance: 0

Alice's first DNFT vault balance: 1 USDT
Alice's first DNFT kerosene balance : 0.5 USD in value.
Alice's first DNFT debt: 1 DYAD USD.

Alice's second vault balance: 100 USDT

She then decides to mint more DYAD USD, but on the second vault. More DYAD minted equals to a lower price of kerosene.

Bob's vault balance: 0

Alice's first DNFT vault balance: 1 USDT
Alice's first DNFT kerosene balance : a little less than 0.5 USD in value.
Alice's first DNFT debt: 1 DYAD USD.

Alice's second DNFT vault balance: 100 USDT
Alice's second DNFT debt: 10 DYAD USD.

Since the kerosene no longer is enough to reach the minimum collateral ratio, Alice's first DNFT becomes able to be liquidated. Alice liquidates herself, and sends the vault's funds to Bob.

Bob's vault balance: 1 USDT

Alice's first DNFT vault balance: 0 USDT
Alice's first DNFT kerosene balance : a little less than 0.5 USD in value.
Alice's first DNFT debt: 0 DYAD USD.

Alice's second DNFT vault balance: 100 USDT
Alice's second DNFT debt: 10 DYAD USD.

Alice successfully sent collateral to Bob.

Recommended Mitigation Steps

If the idea is making the owners of the NFTS being the only ones who can liquidate users to other users, a way to prevent the issue descripted above is making it only possible for the owner of the destiny of the assets to be the one who can liquidate towards that ID.

Assessed type

DoS