Ajna Protocol - J4de's results

Lines of code

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/PositionManager.sol#L320-L323

Vulnerability details

Impact

File: PositionManager.sol
192             // check for previous deposits
193             if (position.depositTime != 0) {
194                 // check that bucket didn't go bankrupt after prior memorialization
195                 if (_bucketBankruptAfterDeposit(pool, index, position.depositTime)) {
196                     // if bucket did go bankrupt, zero out the LP tracked by position manager
197                     position.lps = 0;
198                 }
199             }

The memorializePositions function will check whether the previous depositTime has not yet gone bankrupt. But for the current deposit, it will not be processed, and the current deposit will be processed next time.

File: PositionManager.sol
319         // update position LP state
320         fromPosition.lps -= vars.lpbAmountFrom;
321         toPosition.lps   += vars.lpbAmountTo;
322         // update position deposit time to the from bucket deposit time
323         toPosition.depositTime = vars.depositTime;

In the moveLiquidity function, the previous depositTime of toPosition is not checked and it is directly overwritten. This allows an attacker to use this function to overwrite the depositTime that has not been bankrupted before.

Proof of Concept

1. Alias call memorializePositions, that bucket didn't go bankrupt
2. Alias call moveLiquidity overwritten the depositTime

Tools Used

Manual review

Recommended Mitigation Steps

It is recommended that moveLiquidity function check the depositTime of toPosition

Assessed type

Invalid Validation