Alchemix contest - dirk_y's results

Lines of code

https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L676-L683 https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L704 https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/Limiters.sol#L84

Vulnerability details

Impact

In the AlchemistV2 contract, users can deposit collateral to then borrow/mint the synthetic tokens offered by the protocol. The protocol also defines a minting limit that specifies how many synthetic tokens can be minted in a given time period. This exists to prevent unbounded minting of synthetic tokens.

Every time a user calls mint, the internal _mint method decreases the current mint limit. This works as intended. However, there is nothing stopping an attacker from immediately burning their synthetic tokens by calling burn and then calling mint again. This is possible because the debt position is updated during the burn phase, which lets the user then mint again against the same deposited collateral.

In most cases this probably wouldn't be a problem if the mint limit is sufficiently high. However, it is currently possible for a well financed attacker to grief the contract by repeatedly minting and burning synthetic tokens to keep the contract pegged at the mint limit. This will prevent any normal users from minting any synthetic tokens, and hence prevents the protocol from performing as it should.

Proof of Concept

An attacker can repeatedly call mint followed by burn after depositing some collateral with deposit. If this is appropriately sized and timed, it can cause the mint call to fail for another user due to the check here that is called during mint here.

Tools Used

VSCode

Recommended Mitigation Steps

There should be an additional method added to the Limiters library that can increment the mint limit. This method can then be called during a burn call in the AlchemistV2 contract.

function increase(LinearGrowthLimiter storage self, uint256 amount) internal {
  uint256 value = self.get();
  self.lastValue = value + amount > self.maximum ? self.maximum : value + amount;
}