GoGoPool contest - SamGMK's results

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/tokens/TokenggAVAX.sol#L24

Vulnerability details

Impact

Future depositors are forced to pay a huge value of assets to deposit. It is not practically possible for all users. This could directly affect the attrition of users towards this system.

Proof of Concept

A well-known attack vector for almost all shares-based liquidity pool contracts, where an early user can manipulate the price per share and profit from late users' deposits because of the precision loss caused by the rather large value of price per share. The share price always returns 1:1 with assets. If everything works normally, the share price will slowly increase with time to 1:2 or 1:10 as more rewards come in. But right after ERC4626 contract creation, during the first cycle, any user can deposit 1 share set totalSupply = 1. And transfer the token to the vault to inflate totalAssets before rewards kick in. (Basically, pretend rewards themselves before anyone can deposit in order to get a much better share price.)

Tools Used

Manual

Recommended Mitigation Steps

Consider requiring a minimal amount of share tokens to be minted for the first minter, and send a portion of the initial mints as a reserve to the DAO/ burn so that the price per share can be more resistant to manipulation.