Caviar Private Pools - Cryptor's results

Lines of code

https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L534-L545 https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L229-L231

Vulnerability details

Impact

The protocol allow the owner to set the uint128 variable VirtualBaseTokenReserves. This variable represents the amount of BaseTokens available to be used in the protocol. The owner can set this variable to be as high as possible. The problem with this however, is that the function buy adds the amount of base tokens to the variable VirtualBaseTokenReserves. So it is possible that VirtualBaseTokenReserves will overflow, causing the buy function to revert.

Proof of Concept

The function setVirtualReserves allows an owner of a private pool to set the virtual reserves of a pool shown here

https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L538-L545

The owner set this to any uint128 number, including the max uint128 amount

Also, consider the buy function which allows a user to buy, and when he does whatever base tokens that he used to buy nfts is added to VirtualBaseTokenReserves.

https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L229-L231

This creates a problem where say an owner sets the virtualreserves to type(uint128).max, and subsequently a user calls the function buy. Any input amount greater than 0 will cause VirtualBaseTokenReserves to overflow, causing the buy function to revert.

Tools Used

Manual Review

Recommended Mitigation Steps

A possible mitigation would be to add a requirement to not add to VirtualTokenbaseReserves if it going to overflow.