Spectra - Limbooo's results

Lines of code

https://github.com/code-423n4/2024-02-spectra/blob/383202d0b84985122fe1ba53cfbbb68f18ba3986/src/tokens/PrincipalToken.sol#L460 https://github.com/code-423n4/2024-02-spectra/blob/383202d0b84985122fe1ba53cfbbb68f18ba3986/src/tokens/PrincipalToken.sol#L807 https://github.com/code-423n4/2024-02-spectra/blob/383202d0b84985122fe1ba53cfbbb68f18ba3986/src/tokens/PrincipalToken.sol#L829

Vulnerability details

Rationally, EIP-5095 heavily relies on the framework established by EIP-4626. This is because Principal Tokens can be technically considered as a subset of Yield Bearing Vaults. However, the non-compliant functions appear in both EIPs official requirements.

Impact

Other protocols that integrate with Spectra may wrongly assume that the functions are EIP-5095 compliant. Thus, it might cause integration problems in the future that can lead to wide range of issues for both parties.

Proof of Concept

Here is all official EIP-5095 requirements. Non-compliant functions are listed below, along with the reasons for their non-compliance:

• MUST NOT revert, MUST factor in both global and user-specific limits, like if redemption is entirely disabled (even temporarily) it MUST return 0

  • maxWithdraw, reverts if the contract is paused by whenNotPaused modifier.

• Missing support for approved operator, MUST support a withdraw/redeem flow where the principal tokens are burned from holder directly where holder is msg.sender or msg.sender  has EIP-20 approval over the principal tokens of holder.

  • withdraw, reverts with UnauthorizedCaller when calling _beforeWithdraw if the owner is not the msg.sender.

  • redeem, reverts with UnauthorizedCaller when calling _beforeRedeem if the owner is not the msg.sender.

Tools Used

• Manual Review

Recommended Mitigation Steps

• maxWithdraw should not reverts and return 0 if the contract is paused.

• _beforeWithdraw and _beforeRedeem should check for EIP-20 approval before reverting with UnauthorizedCaller. The internal function ERC20Upgradeable.sol#_spendAllowance() can be used to check and updates owner's allowance for the spender (msg.sender). This fix would also allow other functions like withdrawIBT or redeemForIBT to support approved operator.

Assessed type

Other