Tapioca DAO - Topmark's results

Lines of code

https://github.com/Tapioca-DAO/tapioca-periph-audit/blob/main/contracts/Magnetar/MagnetarV2.sol#L237 https://github.com/Tapioca-DAO/tapioca-periph-audit/blob/main/contracts/Magnetar/MagnetarV2.sol#L215

Vulnerability details

Impact

DOS possibility due to valAccumulator calculation Mistake from repetition of "valAccumulator += _action.value;" at L215 & L237 of MagnetarV2.sol contract which would affect the validity check at L714 "require(msg.value == valAccumulator,..." of MagnetarV2.sol contract

Proof of Concept

The burst(...) function is a long function in the MagnetarV2.sol contract, spanning L194 all the way to L715 which is majorly due to a long loop from L202-L712. For each round of the loop, a cumulative sum of _action.value is calculated at L214-L216. https://github.com/Tapioca-DAO/tapioca-periph-audit/blob/main/contracts/Magnetar/MagnetarV2.sol#L214-L216

202.     for (uint256 i = 0; i < length; i++) {
...
214.     unchecked {
215.        valAccumulator += _action.value;
216.      }

An error occurs if the condition at L232 is met at any point in the loop, where a repetition of the valAccumulator calculation can be spotted

232.            } else if (_action.id == TOFT_WRAP) {
233.                WrapData memory data = abi.decode(_action.call[4:], (WrapData));
234.                _checkSender(data.from);
235.                if (_action.value > 0) {
236.                    unchecked {
237.                        valAccumulator += _action.value;
238.                    }

This will affect the overall value of valAccumulator which will in extension affect the validity of the requirement at L714

714.   require(msg.value == valAccumulator, "MagnetarV2: value mismatch");

Thereby causing a Denial of Service due to non functionality of burst() function

Tools Used

Solidity, Manual Review

Recommended Mitigation Steps

The code at L236-238 is not needed since it would only be a repetition of L214-L216

236.     -  unchecked {
237.     -  valAccumulator += _action.value;
238.     -  }

Assessed type

DoS