Basin - Inspecktor's results

Lines of code

https://github.com/code-423n4/2023-07-basin/blob/main/src/Aquifer.sol#L34-L52

Vulnerability details

Impact

The Aquifer.boreWell function is responsible for creating new Well. This is done using the LibClone.cloneDeterministic function.

The address of the new Well depends solely on the _salt and/or immutableData parameter provided by the user. Once a user create transaction is broadcast, the _salt and/or immutableData parameter can be viewed by anyone viewing the public mempool.

This may result in a DoS for Aquifer.boreWell.

Proof of Concept

If the user intends to create a Well, his create txn can be forcibly revoked by an attacker by deploying the pool to himself using the user's salt. Here's how it might happen:

The user broadcasts the pool creation txn with salt XXX and/or immutableData. The attacker preempts the user's txn and creates a pool for themselves using the same XXX salt and/or immutableData. The initial user creation txn is returned because the attacker pool already exists at the predefined address. This attack can be repeated over and over, resulting in a DoS for the Aquifer.boreWell function.

A similar issue is described in https://github.com/code-423n4/2023-04-caviar-findings/issues/419.

Tools Used

Manual review

Recommended Mitigation Steps

Consider making the upcoming pool address a specific user by concatenating the salt value with the user's address. bytes32 salt = keccak256(abi.encode(msg.sender, _salt))

Assessed type

Context

[L1]: An attacker can initialize Well before an administrator

When Well.sol init() is initialized, the parameters string memory name, string memory symbol are entered, which cannot be changed later in the contract. This function can also be called in Aquifer.boreWell() when certain parameters are set. If this function is not initialized in Aquifer.sol, an attacker can get ahead and set their own values (because init() is public)

https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L31-L43

[L2]: Transfer fee tokens can also be transferred via swapFrom() under certain conditions

There is a swapFromFeeOnTransfer() function to exchange tokens with a transfer fee. However, this can also be done in the swapFrom() function if the condition is met if reserves[i] > _tokens[i].balanceOf(address(this)) (https://github.com/code-423n4/2023-07-basin /blob/main/src/Well.sol#L634) after the token swap. Thus, you can get more tokens at the expense of the contract.

https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L186-L196 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L215-L240 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L634

[L3]: No check for address(0)

There is no check for address(0) for the recipient parameter. You need to add the require(recipient != address(0)) check

https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L191 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L208 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L269 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L355 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L395 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L404

[L4]: No check for the number of sent tokens

The amountIn and amountOut parameters require the require(... != 0) check.

https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L211 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L237 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L303-L304 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L370 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L477

[L5]: Check before _mint that number of tokens != 0

require(lpAmountOut != 0); _mint(recipient, lpAmountOut);

https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L441

[L6]: Check before _burn that number of tokens != 0

require(lpAmountIn != 0); _mint(recipient, lpAmountOut);

https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L471 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L511 https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L566