PoolTogether V5: Part Deux - T1MOH's results

Lines of code

https://github.com/GenerationSoftware/pt-v5-draw-auction/blob/f1c6d14a1772d6609de1870f8713fb79977d51c1/src/RngRelayAuction.sol#L131-L137

Vulnerability details

Impact

RngRelayAuction.rngComplete() misses access control. It is supposed to be called by remote owner, however it doesn't check caller. As a result anyone can withdraw all reserves manipulating random numbers.

Proof of Concept

There is no checks of msg.sender. He can manipulate all the data https://github.com/GenerationSoftware/pt-v5-draw-auction/blob/f1c6d14a1772d6609de1870f8713fb79977d51c1/src/RngRelayAuction.sol#L131-L145

  function rngComplete(
    uint256 _randomNumber,
    uint256 _rngCompletedAt,
    address _rewardRecipient,
    uint32 _sequenceId,
    AuctionResult calldata _rngAuctionResult
  ) external returns (bytes32) {
    if (_sequenceHasCompleted(_sequenceId)) revert SequenceAlreadyCompleted();
    uint64 _auctionElapsedSeconds = uint64(block.timestamp < _rngCompletedAt ? 0 : block.timestamp - _rngCompletedAt);
    if (_auctionElapsedSeconds > (_auctionDurationSeconds-1)) revert AuctionExpired();
    // Calculate the reward fraction and set the draw auction results
    UD2x18 rewardFraction = _fractionalReward(_auctionElapsedSeconds);
    _auctionResults.rewardFraction = rewardFraction;
    _auctionResults.recipient = _rewardRecipient;
    _lastSequenceId = _sequenceId;

    ...
  }

Tools Used

Manual Review

Recommended Mitigation Steps

As I understand, RemoteOwner must control RngRelayAuction.sol. So just add owner to RngRelayAuction.sol and check msg.sender

Assessed type

Invalid Validation