Ethena Labs - RamenPeople's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L232

Vulnerability details

Affected contracts

StakedUSDe

Impact

The overridden _withdraw function checks whether the caller or receiver of the withdrawal is blacklisted (has FULL_RESTRICTED_STAKER_ROLE) and if yes, the withdrawal is reverted.

However, it forgets to check whether the owner is blacklisted. This allows the blacklisted owner to approve another caller address (non-blacklisted) and the approved address can withdraw assets from the blacklisted address.

The protection in _beforeTokenTransfer does not work, because it allows transfers to zero address.

Proof of Concept

See the following scenario:

1. The blacklist manager adds Alice's address to the blacklist. Alice cannot withdraw her tokens.
2. Alice approves the staking token to Bob.
3. Bob withdraws Alice's assets to Bob's address and then transfers them to Alice's address.

Tools Used

Manual review

Recommended Mitigation Steps

Add the owner to the blacklist and check on withdrawal whether the owner of the tokens is blacklisted.

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L225 https://github.com/code-423n4/2023-10-ethena/blob/main/test/foundry/staking/StakedUSDe.blacklist.t.sol#L133

Vulnerability details

Impact

The documentation says that users with SOFT_RESTRICTED_STAKER_ROLE role cannot withdraw staked tokens: "They cannot deposit USDe to get stUSDe or withdraw stUSDe for USDe. However they can participate in earning yield by buying and selling stUSDe on the open market."

However, the code and tests suggest that this functionality is allowed for those users.

Proof of Concept

Here is the statement in documentation: https://github.com/code-423n4/2023-10-ethena/blob/main/README.md#stakedusdev2sol Here is the code that allows addresses with SOFT_RESTRICTED_STAKER_ROLE role withdrawing stake: https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L225 Here is the test that checks that the withdrawal passes for addresses with SOFT_RESTRICTED_STAKER_ROLE role: https://github.com/code-423n4/2023-10-ethena/blob/main/test/foundry/staking/StakedUSDe.blacklist.t.sol#L133

Tools Used

Manual review

Recommended Mitigation Steps

Either block withdrawing by SOFT_RESTRICTED_STAKER_ROLE addresses or update the documentation.

Assessed type

Access Control