Arcade.xyz - crunch's results

Lines of code

https://github.com/code-423n4/2023-07-arcade/blob/f8ac4e7c4fdea559b73d9dd5606f618d4e6c73cd/contracts/ArcadeTreasury.sol#L303-L323

Vulnerability details

Impact

Community approval can be bypassed to spend funds in ArcadeTreasury.

Proof of Concept

Funds in ArcadeTreasury can be spent by GSC or accounts approved by GSC, the spends should not be larger than GSC allowance, which could be set by ADMIN_ROLE through setGSCAllowance method.

    function setGSCAllowance(address token, uint256 newAllowance) external onlyRole(ADMIN_ROLE) {
        if (token == address(0)) revert T_ZeroAddress("token");
        if (newAllowance == 0) revert T_ZeroAmount();


        // enforce cool down period
        if (uint48(block.timestamp) < lastAllowanceSet[token] + SET_ALLOWANCE_COOL_DOWN) {
            revert T_CoolDownPeriod(block.timestamp, lastAllowanceSet[token] + SET_ALLOWANCE_COOL_DOWN);
        }


        uint256 spendLimit = spendThresholds[token].small;
        // new limit cannot be more than the small threshold
        if (newAllowance > spendLimit) {
            revert T_InvalidAllowance(newAllowance, spendLimit);
        }


        // update allowance state
        lastAllowanceSet[token] = uint48(block.timestamp);
        gscAllowance[token] = newAllowance;


        emit GSCAllowanceUpdated(token, newAllowance);
    }

It is worth noting that this method does not reset the token allowance approved by GSC, it's possible that GSC approve larger allowance than the new GSC allowance before the update.

Let's assume: GSC approves 1000e18 to Bob, following that ADMIN_ROLE sets GSC allowance to 500e18, meaning if spends higher than 500e18 should be approved by community, however, Bob's allowance is not reset, he can bypass community approval to spend more than 500e18 tokens.

Tools Used

Manual Review

Recommended Mitigation Steps

Token allowance should be reset if GSC allowance is updated.

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2023-07-arcade/blob/f8ac4e7c4fdea559b73d9dd5606f618d4e6c73cd/contracts/ArcadeTreasury.sol#L189-L201

Vulnerability details

Impact

GSC cannot reduce ArcadeTreasury token allowance.

Proof of Concept

GSC can approve tokens to be pulled from the treasury by calling gscApprove method, the approved allowance will be deducted from GSC allowance.

    function gscApprove(
        address token,
        address spender,
        uint256 amount
    ) external onlyRole(GSC_CORE_VOTING_ROLE) nonReentrant {
        if (spender == address(0)) revert T_ZeroAddress("spender");
        if (amount == 0) revert T_ZeroAmount();


        // Will underflow if amount is greater than remaining allowance
        gscAllowance[token] -= amount;


        _approve(token, spender, amount, spendThresholds[token].small);
    }

It's possible that GSC cannot reduce the allowance due to underflow. Let's assume: GSC allowance is 1500e18, GSC approves 1000e18 tokens to Bob and GSC allowance becomes 500e18 (1500e18 - 1000e18), if GSC want to reduce Bob's allowance to 800e18, transaction will fail because of the underflow (500e18 - 800e18).

Tools Used

Manual Review

Recommended Mitigation Steps

Please consider to not reduce GSC allowance if new approve allowance is less than old approve allowance.

Assessed type

Access Control