DYAD - dinkras's results

Lines of Code

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L127 https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L143

IMPACT

DOS of all withdrawals in a given block thus manipulating the Kerosine price in certain conditions

Proof of concept

An attacker can block all withdrawals txs in a given block by frontrunning the users who want to withdraw and call deposit() with 0 wei and the victim's nft Ids. The flash loan prevention mechanism forbids the users to deposit and withdraw at the same block. This will lead to reverts when the victims try to withdraw.

Since the Kerosine price is calculated with the tvl of all exocollateral assets in mind, in case of huge sum withdrawals from users, the attacker can block their withdrawals -> manipulate the Kerosine price and take advantage of the price.

Redeeming Dyad functionality could also be blocked for the current block with this approach.

This is all possible because anyone can deposit with someone else's NFT with the combination of the flash loan prevention mechanism of DYAD protocol.

Tools used

Manual review

Reccomended Mitigation Steps

Add a isDNftOwner(id) modifier in VaultManagerV2.deposit() so only the NFT owner can deposit

Assessed Type

DOS

Lines of Code:

https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L146-L150 https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/Vault.kerosine.unbounded.sol#L15

Impact

All deposited Kerosine tokens inside Vault.kerosine.unbounded.sol get stuck and cannot be withdrawn by anyone

Proof of Concept

When a user tries to withdraw his Kerosine tokens from a Kerosine vault he calls the VaultManagerV2.withdraw(). When calculating the value(L 146) the _vault.oracle() field is used for the calculation. However this field does not exist inside Vault.kerosine.unbounded.sol and an EVM error is thrown. As a result all withdraw txs of Kerosine tokens are reverted. This leads to frozen funds https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/VaultManagerV2.sol#L146-L150

POC: https://gist.github.com/dinkras/8d4508b34c9f33487a2e2027011a6ac6

Tools Used

Manual review

Recommended Mitigation Steps

Implement withdraw specific logic for the Kerosin vault in VaultManagerV2.sol

Assessed Type

DOS