FIAT DAO veFDT contest - ayeslick's results

Lines of code

https://github.com/code-423n4/2022-08-fiatdao/blob/main/contracts/features/Blocklist.sol#L25

Vulnerability details

Impact

If a manager decides to add a contract to the block list he will call the block function within the BlockList contract. An operator can front run any calls to the block function that passes the operator's malicious smart wallet address with a SELFDESTRUCT call to his contract. This will cause the _isContract function to fail. The operator then can redeploy his contract to the same address using CREATE2.

Proof of Concept

The operator deploys a malicious smart wallet via a factory using CREATE2.

Manager spots the malicious smart wallet

Manager calls the block function with the malicious smart wallet’s address

The operator of this malicious smart wallet sees this call in the mempool

The operator front runs the manager's call to the block function with a SELFDESTRUCT call to his malicious smart wallet.

The manager's call to the block function fails because the address for the malicious smart wallet no longer has code.

The operator back runs the manager's call with a CREATE2 call to the factory which redeploys the same contract to the same address.

Recommended Mitigation Steps

Block the address whether it’s a contract or not perhaps creating an approvedList which could work as well.