DYAD - Daniel526's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L156-L169

Vulnerability details

Impact

The impact of this vulnerability is that users could exploit the system to mint dyad tokens based on inflated collateral values, leading to an imbalance between minted dyad tokens and the actual value of collateral backing them. This could undermine the stability and integrity of the DeFi system, potentially resulting in losses for users and destabilization of the ecosystem.

Proof of Concept

The vulnerability arises from the possibility of depositing multiple assets into separate vaults associated with the same dNFT position and then minting dyad tokens against the total collateral value across all vaults. The contract logic, particularly in the mintDyad function, does not adequately account for this scenario, potentially allowing users to over-collateralize and mint dyad tokens based on duplicated collateral.

Here's the relevant section of the code:

function mintDyad(
    uint    id,
    uint    amount,
    address to
  )
    external 
      isDNftOwner(id)
  {
    uint newDyadMinted = dyad.mintedDyad(address(this), id) + amount;
    if (getNonKeroseneValue(id) < newDyadMinted)     revert NotEnoughExoCollat();
    dyad.mint(id, to, amount);
    if (collatRatio(id) < MIN_COLLATERIZATION_RATIO) revert CrTooLow(); 
    emit MintDyad(id, amount, to);
  }

In this function, newDyadMinted calculates the total dyad tokens minted after the new minting operation. However, it does not consider the possibility of multiple vaults associated with the same dNFT, potentially leading to an incorrect calculation of the total collateral value. For example, if a user has two vaults attached to their dNFT position, each containing 100 units of asset A and asset B respectively, they could potentially deposit both assets as collateral and mint dyad tokens against the combined value of 200 units of asset A and 200 units of asset B, even though they only have 100 units of each asset in total.

Tools Used

Manual

Recommended Mitigation Steps

The contract should implement a mechanism to track the total collateral value across all vaults associated with a particular dNFT position. This mechanism would ensure that the minting of dyad tokens cannot exceed the total collateral value, thereby preventing over-collateralization and double-spending.

Assessed type

Context