Revert Lend - cryptphi's results

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/transformers/AutoRange.sol#L276-L297

Vulnerability details

Impact

The AutoRange.configToken() function updates the state variable positionConfigs for a tokenId and callable by the owner of the tokenId. However, in the call to AutoRange.execute(), the state variable positionConfigs for the tokenid is used in setting the local variable PositionConfig memory config without any further check to ensure the config has been set by the current owner of the tokenId

This in some way could affect the swapcall on the token position such that the protocol does not receive any incentive.

Proof of Concept

1. Alice is an operator and owns token 1 and sets the configToken() to configure token to be used before calling executeWithVault()

https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/transformers/AutoRange.sol#L276-L297

positionConfigs state variable for tokenId is set in configToken() by token owner.

function configToken(uint256 tokenId, address vault, PositionConfig calldata config) external {
        _validateOwner(tokenId, vault);

        // lower tick must be always below or equal to upper tick - if they are equal - range adjustment is deactivated
        if (config.lowerTickDelta > config.upperTickDelta) {
            revert InvalidConfig();
        }

        positionConfigs[tokenId] = config;

2. After a while and eventually Alice no longer has any position on token and transfers the token to Bob.

3. Bob is another operator and calls executeWithVault(), the calls happen using the old token config set by Alice. https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/transformers/AutoRange.sol#L111-L116

positionConfigs[tokenId] set by a previous tokenId owner being used.

function execute(ExecuteParams calldata params) external {
        if (!operators[msg.sender] && !vaults[msg.sender]) {
            revert Unauthorized();
        }
        ExecuteState memory state;
        PositionConfig memory config = positionConfigs[params.tokenId];

Tools Used

Manual

Recommended Mitigation Steps

Using an enumerable set or additional mapping parameter to set the current owner in the positionConfigs state variable and an additional check in execute() to ensure the config was set by token owner.

Assessed type

Other

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/transformers/LeverageTransformer.sol#L124

Vulnerability details

Impact

The leverageDown functions in LeverageTransformer contract are expected to be called by V3Vault. However, there is no access control to check that the caller is an authorized V3Vault address.

Due to this, it is possible for any user owned contract to be approved for erc20 tokens and steal tokens held in the contract https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/transformers/LeverageTransformer.sol#L165C9-L166C65

Proof of Concept

https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/transformers/LeverageTransformer.sol#L165C9-L166C65

Tools Used

Manual

Recommended Mitigation Steps

Add a check to ensure caller is approved vault address

Assessed type

ERC20