Caviar Private Pools - Norah's results

Lines of code

https://github.com/code-423n4/2023-04-caviar/blob/main/src/PrivatePool.sol#L459-L476

Vulnerability details

Detailed description of the impact of this finding.

Impact

Funds approved by users to be used by private pools for buying NFTs or provide fees incase of swapping NFT can be captured by the owner.

Proof of Concept

Consider following scenario :

• Normal users have approved a private pool contract to use a certain amount of their base token to pay for the NFTs they want to buy from the pool.
• Then they call the buy() function to buy the NFTs from the pool.
• Now malicious owner of the pool can observe these two transaction on mempool, and place their following transaction between the two:
• Owner calls execute function with target address of base tokens contract and signature of transferFrom function with parameters : -- Approved amount -- His own address
• This way the Owner (Attacker) gets users' funds which were intended to buy the NFTs.
• Also, Most of the time normal users would approve more than needed for a transaction for the sake of convenience. Often huge amounts.
• In that case the owner (Attacker) won't even have to front run any users transaction, he/she can call execute any time later on as mentioned to steal the reaming apprpved funds from users funds.

Tools Used

Manual Analysis

Recommended Mitigation Steps

• The Execute function is there to protect the owner in certain cases, but it can be exploitable by the owner as mentioned.
• Better way would be to provide an emergency function with limited access to the owner while also protecting her/his interest.