Ajna Protocol - azhar's results

Lines of code

https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/PositionManager.sol#L176 https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/base/Pool.sol#L515-L516

Vulnerability details

Impact

PositionManager contract allows anyone to memorializePosition lender's NFT position without the owner's permission. if the owner already gave allowance to PositionManager's contract address in Pool contracts' approveLPTransferors function. Under the PostionManager contract memorializePositions function it's get address owner = ownerOf(params_.tokenId); owner address from user submitted params. that's the bug here.

For example Alice has 1 position NFT and he gave allowance to positionmanager's contract address and he decided after 2-3 months he could memorialize that but the BOB noticed this. Bob memorialize the Alice's NFT after Alice gave the allowance.

Proof of Concept

https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/PositionManager.sol#L176

https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/base/Pool.sol#L515-L516

Tools Used

Manual Review

Recommended Mitigation Steps

Inside the memorializePositions function check the user access like this

address owner = ownerOf(params_.tokenId);
require(owner == msg.sender, "Not Allowed");

Assessed type

Access Control