DYAD - c0pp3rscr3w3r's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L119-L128

Vulnerability details

Impact

Anyone can call deposit for an Id that's owned by someone for amount zero (0). This can prevent withdraw attempts for Id in the same block

Proof of Concept

• Deposit can be called by any address with a valid id and it'll set idToBlockOfLastDeposit to current block number despite no asset sent.

  function deposit(
    uint    id,
    address vault,
    uint    amount
  ) 
    external 
    isValidDNft(id)
  {
    idToBlockOfLastDeposit[id] = block.number;
    Vault _vault = Vault(vault);
    _vault.asset().safeTransferFrom(msg.sender, address(vault), amount);
    _vault.deposit(id, amount);
  }

• Here in the withdraw function, we can see that the function reverts if withdraw is done in the same block as a deposit.

  function withdraw(
    uint    id,
    address vault,
    uint    amount,
    address to
  ) 
    public
      isDNftOwner(id)
  {
@>    if (idToBlockOfLastDeposit[id] == block.number) revert DepositedInSameBlock();
 //@audit we revert if the idToBlockOfLastDeposit is in the same block for id
..

Tools Used

manual analysis

Recommended Mitigation Steps

Have zero amount checks

Assessed type

DoS