Tapioca DAO - Oxsadeeq's results

Lines of code

https://github.com/Tapioca-DAO/tapioca-bar-audit/blob/2286f80f928f41c8bc189d0657d74ba83286c668/contracts/markets/bigBang/BigBang.sol#L282

Vulnerability details

Impact

Detailed description of the impact of this finding. The function addCollateral() in the bigBang Market,allows a caller to add collateral from another user's account provided he has allowance, but this is like a two edged sword meant to solve a particular problem,while giving an edge to people with malicious intent.The modifier allowedBorrow meant to ensure that the caller is allowed by the user has a flaw(It only checks that the caller has allowance for an amount of shares , it doesn't check if the caller is allowed to add Collateral from the yieldBox account), there are two methods of adding collateral the first method is directly from the user's yieldBox deposit while the latter adds collateral from the users collateral, to bypass the allowedBorrow modifier a malicious user would have to specify share as 0 and after the check passes the amount of Collateral specified by the Malicious user is transferred from the user to the Malicious User.A simple attack flow goes like this: 1)Malicious user calls addCollateral() passing his address,another users address,amount and share as 0 2) They checks passes because of the 0 shares. 3)The amount specified are transferred from the user to the address of the Malicious user

modifier allowedBorrow(address from, uint share) virtual { _allowedBorrow(from, share); _; } function _allowedBorrow(address from, uint share) internal { if (from != msg.sender) { if (allowanceBorrow[from][msg.sender] < share) { revert NotApproved(from, msg.sender); } allowanceBorrow[from][msg.sender] -= share; }

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Vscode

Recommended Mitigation Steps:Add checks to check that the caller has both check to Borrow shares and borrow from the users yieldbox account

Assessed type

Invalid Validation