Frax Ether Liquid Staking contest - Triangle's results

A liquid ETH staking derivative designed to uniquely leverage the Frax Finance ecosystem.

General Information

Platform: Code4rena

Start Date: 22/09/2022

Pot Size: $30,000 USDC

Total HM: 12

Participants: 133

Period: 3 days

Judge: 0xean

Total Solo HM: 2

Id: 165

League: ETH

Frax Finance

Findings Distribution

Researcher Performance

Rank: 70/133

Findings: 2

Award: $40.84

🌟 Selected for report: 0

🚀 Solo Findings: 0

Lines of code

https://github.com/code-423n4/2022-09-frax/blob/main/src/sfrxETH.sol#L68 https://github.com/code-423n4/2022-09-frax/blob/main/src/sfrxETH.sol#L84

Vulnerability details

Impact

If deposit or mint for the SAME ADDRESS second time, permit is needless as we have called APPROVE type(uint256).max qty before.

Proof of Concept

Permit groups

  1. Approve
  2. Transfer from

calls into 1, and the recipient executes both calls and pays for both gas in the same transaction. However, if APPROVE type(uint256).max qty was called before, We won't need #1 and only need #2 call to transfer out the token. Therefore, if we want to use permit for second onwards transfer from for the same address, the approved qty should be the same as the transferred amount.

Suggestion:

  1. Remove #68 and #84 lines.
  2. Use asset.permit(msg.sender, address(this), assets, deadline, v, r, s); and asset.permit(msg.sender, address(this), shares, deadline, v, r, s); instead.

Tools Used

Foundry

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter