InsureDAO contest - cccz's results

Handle

cccz

Vulnerability details

Impact

The fund function of the CDSTemplate contract does not match the description, the caller will not receive any iToken after sending tokens, and the owner can take away the tokens in surplusPool.

    /**
     * @notice A liquidity provider supplies collatral to the pool and receives iTokens
     * @param _amount amount of token to deposit
     */
    function fund(uint256 _amount) external {
        require(paused == false, "ERROR: PAUSED");

        //deposit and pay fees
        uint256 _attribution = vault.addValue(
            _amount,
            msg.sender,
            address(this)
        );

        surplusPool += _attribution;

        emit Fund(msg.sender, _amount, _attribution);
    }

    function defund(uint256 _amount) external override onlyOwner {
        require(paused == false, "ERROR: PAUSED");

        uint256 _attribution = vault.withdrawValue(_amount, msg.sender);
        surplusPool -= _attribution;

        emit Defund(msg.sender, _amount, _attribution);
    }

Proof of Concept

https://github.com/code-423n4/2022-01-insure/blob/main/contracts/CDSTemplate.sol#L156-L182

Tools Used

Manual analysis

Recommended Mitigation Steps

Change the description of the fund function or send iToken to the caller

Handle

cccz

Vulnerability details

Impact

When setting parameters in the Parameters contract, the input parameters are not verified.

For example, in the setFeeRate function, the _target parameter is not limited. When _target is greater than 1e6, DOS will occur when used in the insure function of the PoolTemplate contract

    function setFeeRate(address _address, uint256 _target)
        external
        override
        onlyOwner
    {
        _fee[_address] = _target;
        emit FeeRateSet(_address, _target);
    }
   ...
   function insure(
        uint256 _amount,
        uint256 _maxCost,
        uint256 _span,
        bytes32 _target
    ) external returns (uint256) {
        //Distribute premium and fee
        uint256 _endTime = _span + block.timestamp;
        uint256 _premium = getPremium(_amount, _span);
        uint256 _fee = parameters.getFeeRate(msg.sender);

        require(
            _amount <= availableBalance(),
            "ERROR: INSURE_EXCEEDED_AVAILABLE_BALANCE"
        );
        require(_premium <= _maxCost, "ERROR: INSURE_EXCEEDED_MAX_COST");
        require(_span <= 365 days, "ERROR: INSURE_EXCEEDED_MAX_SPAN");
        require(
            parameters.getMinDate(msg.sender) <= _span,
            "ERROR: INSURE_SPAN_BELOW_MIN"
        );

        require(
            marketStatus == MarketStatus.Trading,
            "ERROR: INSURE_MARKET_PENDING"
        );
        require(paused == false, "ERROR: INSURE_MARKET_PAUSED");

        //current liquidity
        uint256 _liquidity = totalLiquidity();
        uint256 _totalCredit = totalCredit;

        //accrue premium/fee
        uint256[2] memory _newAttribution = vault.addValueBatch(
            _premium,
            msg.sender,
            [address(this), parameters.getOwner()],
            [MAGIC_SCALE_1E6-_fee, _fee]
        );

Proof of Concept

https://github.com/code-423n4/2022-01-insure/blob/main/contracts/Parameters.sol

Tools Used

Manual analysis

Recommended Mitigation Steps

When setting parameters in the Parameters contract, verify the input parameters