DYAD - Pechenite's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L119-L153

Vulnerability details

Impact

Everyone can DoS the owners of DYAD to withdraw by depositing for this NFT.

Proof of Concept

The idToBlockOfLastDeposit mapping keeps track of the last block in which a deposit was made for each dNFT.

mapping (uint => uint) public idToBlockOfLastDeposit;

// ...

function deposit(
  uint    id,
  address vault,
  uint    amount
) 
  external 
  isValidDNft(id)
{
  idToBlockOfLastDeposit[id] = block.number;
  Vault _vault = Vault(vault);
  _vault.asset().safeTransferFrom(msg.sender, address(vault), amount);
  _vault.deposit(id, amount);
}

During a withdrawal attempt, a check prevents withdrawal in the same block as the last deposit:

function withdraw(
  uint    id,
  address vault,
  uint    amount,
  address to
) 
  public 
  isDNftOwner(id)
{
  if (idToBlockOfLastDeposit[id] == block.number) revert DepositedInSameBlock();
  // Further code for withdrawals...
}

Since anyone can deposit for any dNFT, a malicious actor could make deposits into a specific dNFT, preventing the owner from withdrawing in the same block, thus causing a DoS attack.

Tools Used

Manual review

Recommended Mitigation Steps

Implement an additional authorization check to ensure that only the dNFT owner can deposit into their own vault.

Assessed type

Context