Revert Lend - Timenov's results

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/transformers/V3Utils.sol#L115-L352

Vulnerability details

Impact

In V3Utils::execute, users can Execute instruction by pulling approved NFT instead of direct safeTransferFrom call from owner. However there is no validation whether the caller is the owner of the tokenId or approved address.

Proof of Concept

As we can see in executeWithPermit, there is a validation:

        if (nonfungiblePositionManager.ownerOf(tokenId) != msg.sender) {
            revert Unauthorized();
        }

But there is no such check in execute or a check if the msg.sender is approved.

Consider the following scenario:

1. User A approves nonfungiblePositionManager.
2. User A calls execute with his instructions.
3. User B sees the tx and frontruns User A, but with different instructions.

Tools Used

Manual Review

Recommended Mitigation Steps

Add validation if the msg.sender is owner or approved.

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/transformers/LeverageTransformer.sol#L39-L40 https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/transformers/LeverageTransformer.sol#L122-L123

Vulnerability details

Impact

As per the comments of the functions leverageUp and leverageDown in LeverageTransformer.sol, these functions are supposed to be called by the transform function in the Vault. However there is no such protection and anyone can call them.

Proof of Concept

As there is no access control, a malicious user can craft a smart contract that will use for his needs.

First lets look at what the attacker can configure leverageUp function.

1. The token will be IVault(msg.sender).asset()
2. Function call IVault(msg.sender).borrow(params.tokenId, amount)

Now lets look at leverageDown.

1. Token will be IVault(msg.sender).asset()
2. Token approve SafeERC20.safeApprove(IERC20(token), msg.sender, amount)
3. Function call IVault(msg.sender).repay(params.tokenId, amount, false)

Tools Used

Manual Review

Recommended Mitigation Steps

Add state variable of type address vault, set the value in the constructor, add validation require(msg.sender == vault, "only vault.");. Also function updateVault can be created in order to change the address in the future. Do not forget to add onlyOwner modifier to that function.

Assessed type

Access Control