DYAD - Mrxstrange's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L119-L153

Vulnerability details

Vulnerability details

• The contract VaultManagerV2.sol#L137 uses a withdrawal function that initially checks the deposit time block. This is because if a DNFT owner attempts to deposit and withdraw in the same block, the function will revert

• This condition check creates vulnerability to a frontrunning attack. Since the deposit function only verifies if the caller is a valid DNFT owner but does not verify if the caller owns the specific ID (isDNftOwner), it becomes susceptible. For instance, if a DNFT owner triggers the withdraw function, simultaneously an attacker monitors the mempool for the victim's transaction. The attacker then deposits some amount to the victim's ID in the same block, executing a frontrunning attack. Consequently, the victim's withdrawal transaction is reverted due to the condition: if (idToBlockOfLastDeposit[id] == block.number) revert DepositedInSameBlock();

Code snippet

VaultManagerV2.sol

function deposit(
 ...
  ) 
    external 
      isValidDNft(id)
  {
    idToBlockOfLastDeposit[id] = block.number; 
...   
}


function withdraw(
 ...
  ) 
    public
      isDNftOwner(id)
  {
    if (idToBlockOfLastDeposit[id] == block.number) revert DepositedInSameBlock();  
...
...
}

Tools Used

Vs code

Assessed type

Access Control