PartyDAO contest - ayeslick's results

Lines of code

https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/crowdfund/AuctionCrowdfund.sol#L178

Vulnerability details

Impact

The docs say that a crowdfund should only use trusted market wrappers but how would an average person know if the crowdfund they’re contributing to is using a trusted market wrapper? The potential impact is described in part below.

Proof of Concept

An operator deploys an Auction Crowdfund with a malicious market wrapper.

Auction Crowdfund delegate calls the market wrapper. As a result, the malicious market wrapper can manipulate everything within the Auction Crowdfunds context except for immutable & constant variables.

With this, the operator can create a market wrapper that:

Drains the ETH from the contract.

Doesn’t bid when the function is called but instead sends the ETH to an address the operator controls.

Changes the nftContract variable to a custom NFT that the operator transfers to the contract. When the finalize function is called it checks for this custom contract and creates a party around the wrong NFT

Calls another operator-controlled contract that does the bidding. If the auction is successful, the NFT goes to the operator-controlled contract. When finalize is called it will show that it was unsuccessful because the contract does not have the NFT. In a nutshell, the operator is able to use Auction funds to win the NFT but the contributors get nothing.

Recommended Mitigation Steps

Hash and store all of the variables before and after the delegate call to the market wrapper then compare the results after to make sure nothing was modified. Similar to the way governanceOpts is checked.

OR

Restrict the market wrappers creators can use.

OR

Provide a set of trusted market wrappers. If a crowdfund creator uses a market wrapper that isn’t trusted highlight this so contributors can make an informed decision.