DYAD - DedOhWale's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L119-L131 https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L133-L153

Vulnerability details

The smart contract allows for zero-value deposits via the deposit function, which updates a mapping (idToBlockOfLastDeposit) to the current block number regardless of the deposit amount. This functionality can be misused to manipulate the protocol's state to block legitimate withdrawals. When a zero-value deposit is made, the idToBlockOfLastDeposit[id] is set to the current block number, interfering with subsequent withdraw operations due to the DepositedInSameBlock check.

Impact

This vulnerability can be exploited to perform a Denial of Service (DoS) attack on the protocol. An attacker can continually make zero-value deposits, thereby preventing legitimate users from withdrawing their assets by triggering the DepositedInSameBlock revert condition in the same block. This could lead to significant disruptions in the protocol's functionality, undermining user trust and the overall integrity of the system.

Proof of Concept

  function deposit(
    uint    id,
    address vault,
    uint    amount
  ) 
    external 
      isValidDNft(id)
  {
    idToBlockOfLastDeposit[id] = block.number;
    ...
  }

As the deposit function is only checking that the id is a valid NFT, anyone can deposit to any id, including malicious actors. This poses a problem to users that want to withdraw within the same block that someone else has deposited into their id.

  function withdraw(
    uint    id,
    address vault,
    uint    amount,
    address to
  ) 
    public
      isDNftOwner(id)
  {
    if (idToBlockOfLastDeposit[id] == block.number) revert DepositedInSameBlock();
    ...
  }

Suppose:

1. Alice wants to withdraw her assets
2. Malicious actor Bob sees the withdraw in the mempool and wants to stop her
3. Bob reorders transactions to get himself in the same block and deposits 0 ahead of her
4. Alice cannot withdraw

A bot could brick the protocol by simply sending 0 to all id's every block as well.

Tools Used

manual review

Recommended Mitigation Steps

Only allow NFT owners to deposit.

Assessed type

DoS

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L205-L228

Vulnerability details

VaultManagerV2 contains separate handling for kerosene and non-kerosene vaults but does not appropriately manage these distinctions during liquidations. Specifically, the liquidation function fails to account for vaults tagged as "kerosene," which means assets in these vaults are effectively exempt from liquidation. This misalignment is due to the collatRatio calculation considering the totalUSDValue from both kerosene and non-kerosene vaults, yet the actual liquidation process only targets non-kerosene vaults. This discrepancy allows users to circumvent liquidation by strategically classifying their vaults as kerosene.

Impact

This vulnerability could lead to significant financial and operational risks:

1. Avoidance of Asset Liquidation: Users can prevent their assets from being liquidated by assigning them to kerosene vaults, thus exploiting a loophole to maintain control over assets that should otherwise be subject to liquidation under distressed conditions.
2. System Integrity and Risk Management Failures: The system’s ability to manage risk and maintain its integrity is compromised, as it fails to enforce its risk controls consistently across different asset categories.
3. Economic Disincentives: This loophole might encourage strategic behavior that undermines the economic mechanisms designed to stabilize and secure the platform's operations.

Proof of Concept

Consider a scenario where a user wants to avoid liquidation:

1. The user places a significant amount of collateral into a vault classified as kerosene.
2. The user then engages in high-risk activities that would typically lead to a liquidation scenario due to low collateralization ratios.
3. Upon triggering the liquidate function, only non-kerosene vaults are considered for asset movement, leaving the substantial collateral in kerosene vaults untouched, despite potentially contributing to an overall risky collateralization ratio.

Tools Used

manual review

Recommended Mitigation Steps

Either do not account for the kerosene vault's USD value, or allow for liquidation of them.

Assessed type

Error