Ajna Protocol - ToonVH's results

Lines of code

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/PositionManager.sol#L170-L216 https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/PositionManager.sol#L227-L241

Vulnerability details

Impact

The mint() and memorializePositions() functions in PositionManager.sol have little access control. As such anyone can mint() an empty NFT to an arbitrary address afterwhich they can memorialize any positions this address has to this NFT. Since the owner of the position becomes the owner of the NFT no funds are lost, however this can still be used to grief the owner. The only constraint is that the owner needs to have approved the PositionManager, this could be the case if the owner previously minted/memorialized any NFTs.

File: PositionManager.sol
170:     function memorializePositions(
171:         MemorializePositionsParams calldata params_
172:     ) external override {
173:         EnumerableSet.UintSet storage positionIndex = positionIndexes[params_.tokenId];
174: 
175:         IPool   pool  = IPool(poolKey[params_.tokenId]);
176:         address owner = ownerOf(params_.tokenId);

             ...

212:         // update pool LP accounting and transfer ownership of LP to PositionManager contract
213:         pool.transferLP(owner, address(this), params_.indexes);
214: 
215:         emit MemorializePosition(owner, params_.tokenId, params_.indexes);
216:     }

Tools Used

Manual review

Recommended Mitigation Steps

• Verify that msg.sender is the recipient/owner of the NFT during minting/memorialization.

Assessed type

Access Control