DYAD - Cryptor's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L143

Vulnerability details

Impact

A user can front run and block withdrawals by calling deposit before the victim

Proof of Concept

The function deposit and withdraw both have the following mechanism to prevent flash loan attacks

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L127

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L143

  idToBlockOfLastDeposit[id] = block.number;

    if (idToBlockOfLastDeposit[id] == block.number) revert DepositedInSameBlock();

The problem here is that a bad actor can prevent other users from withdrawing by front running users (by providing a higher gas fee) and then calling the function deposit with the same id, causing the withdraw function to revert. In addition, since there is no minimum amount for the deposit, this front running attack can be done for little to no cost.

Tools Used

Manual Review

Recommended Mitigation Steps

Use openZepplin's re-entrancy lock instead of block.number

Assessed type

DoS

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L224 https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L155-L169

Vulnerability details

Impact

There is no incentive to liquidate small positions

Proof of Concept

The function mintdyad allows a user to create a position to mint dyad.

    function mintDyad(
    uint    id,
    uint    amount,
    address to
  )
    external 
      isDNftOwner(id)
  {
    uint newDyadMinted = dyad.mintedDyad(address(this), id) + amount;
    if (getNonKeroseneValue(id) < newDyadMinted)     revert NotEnoughExoCollat();
    dyad.mint(id, to, amount);
    if (collatRatio(id) < MIN_COLLATERIZATION_RATIO) revert CrTooLow(); 
    emit MintDyad(id, amount, to);
  }

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L155-L169

Notice that there is no minimum amount to mint. A user can create extremely small positions (e.g. 7e5). This can be a problem when looking at the the liquidate function.

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L204-L228

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L224

   uint  collateral = vault.id2asset(id).mulWadUp(liquidationAssetShare);

For example, let's say that the collateral is equal to 5 USD and the liquidation asset share is equal to 1. If the gas price is high (e.g .01 ETH), the liquidator can incur a significant net loss.

Here we see that the liquidator can get little to no reward for initiating the liquidate if the liquidated collateral is too low. If this is done during times of high volatility, the liquidator can end up in a net loss after paying gas fees. This creates a lack of incentive to liquidate small positions. Eventually, this can lead to a lot of bad debt accumulated by the protocol.

Tools Used

Manual Review

Recommended Mitigation Steps

When minting dyad, add a minimum amount to incentivize users to liquidate positions

Assessed type

Other