Lybra Finance - azhar's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/token/PeUSDMainnetStableVision.sol#L133 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/token/PeUSDMainnetStableVision.sol#L137

Vulnerability details

Impact

PeUSDMainnetStableVision.sol contract's executeFlashloan function does not have proper access control. Therefore anyone can put any user's flashborrow contract address and execute the flashloan and the PeUSDMainnetStableVision.sol will take a fee as well, if they gave unlimited EUSD approval or even a limited amount of approval to the PeUSDMainnetStableVision contract. An attacker can repeat this setup until the user's entire contract is drained.

Proof of Concept

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/token/PeUSDMainnetStableVision.sol#L133 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/token/PeUSDMainnetStableVision.sol#L137

Tools Used

Manual Review

Recommended Mitigation Steps

under the executeFlashloan's function check this access control to prevent this attack.

function executeFlashloan(FlashBorrower receiver, uint256 eusdAmount, bytes calldata data) public payable {

require(address(receiver) == msg.sender, "Not allowed");
...

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L35 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L10

Vulnerability details

Impact

LybraWbETHVault contract using WBETH's interface and get the asset price in getAssetPrice() function. Inside that getAssetPrice() it's calling exchangeRatio() from the WBETH contract. but current on-chain WBETH contract is having exchangeRate() function only. Therefore, depositEtherToMint() function will fail forever and brick the contract permanently.

Proof of Concept

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L35

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L10

https://etherscan.io/token/0xa2e3356610840701bdf5611a53974510ae27e2e1#readProxyContract#F13

Tools Used

Manual Review

Recommended Mitigation Steps

Change the interface from function exchangeRatio() external view returns (uint256); to function exchangeRate() external view returns (uint256); and inside the getAssetPrice() function implement like this to mitigate the issue.

 function getAssetPrice() public override returns (uint256) {
        return (_etherPrice() * IWBETH(address(collateralAsset)).exchangeRate()) / 1e18;
    }

Assessed type

DoS