Ethena Labs - PASCAL's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/EthenaMinting.sol#L351-L355 https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/EthenaMinting.sol#L169-L171

Vulnerability details

Impact

The EthenaMinting.mint function will always revert .

Proof of Concept

The orderType passed into the mint function, is of type mint so there is a check to verify the route.

function mint(Order calldata order, Route calldata route, Signature calldata signature) external override nonReentrant onlyRole(MINTER_ROLE) belowMaxMintPerBlock(order.usde_amount) { if (order.order_type != OrderType.MINT) revert InvalidOrder(); verifyOrder(order, signature); if (!verifyRoute(route, order.order_type)) revert InvalidRoute();

Inside the verifyRoute() there is a check that returns true if the orderType == REDEEM,

function verifyRoute(Route calldata route, OrderType orderType) public view override returns (bool) { // routes only used to mint if (orderType == OrderType.REDEEM) { return true;

Which is not supposed to be so since in mint function if verifyRouter returns false it reverts and the orderType passed from the mint function into the verifyRoute function is always of type mint so it will always revert.

Tools Used

Manual Review

Recommended Mitigation Steps

Change that REDEEM to MINT in the verifyRouter or change the true to false

Assessed type

DoS