Venus Protocol Isolated Pools - chaieth's results

Lines of code

https://github.com/code-423n4/2023-05-venus/blob/8be784ed9752b80e6f1b8b781e2e6251748d0d7e/contracts/RiskFund/RiskFund.sol#L225-L276

Vulnerability details

Impact

Protocols shouldn't set the deadline to block.timestamp as a validator can hold the transaction and the block it is eventually put into will be block.timestamp, so this offers no protection.

Proof of Concept

A malicious miner can hold the transaction, which may be done in order to free up capital to ensure that there are funds available to do operations to prevent a liquidation. It is highly likely that a liquidation is more profitable for a miner to mine, with its associated follow-on transactions, than to allow the decrease of liquidity. A miner can also just hold it until maximum slippage is incurred.

https://dacian.me/defi-slippage-attacks#heading-no-expiration-deadline https://twitter.com/0xOwenThurm/status/1614289583679868928?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1614289583679868928%7Ctwgr%5E55271315238a0ac7aed61ff53e7105981a6db1ee%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fcdn.iframe.ly%2FzzyzcMI%3Fapp%3D1 https://code4rena.com/reports/2022-11-paraspace/#m-13-interactions-with-amms-do-not-use-deadlines-for-operations

Tools Used

Manual review

Recommended Mitigation Steps

Protocols should allow users to set expiration deadlines; no expiration deadline may create a potential critical loss of funds vulnerability for any user initiating a swap.

Assessed type

Timing