Dopex - etherhood's results

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/main/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L125

Vulnerability details

Impact

Anyone can deposit and withdraw in same transaction stealing funding payment prior without providing collateral

Proof of Concept

In deposit function, after calculation of shares, perpetualAtlanticVault.updateFunding(); is called, which in turn transfers funding amount to vault, and when user redeems this value will be used in determining his share, which will as a result be more than what he deposited initially, leading to stealing of yield from all other users who deposited before.

Tools Used

VSCode

Recommended Mitigation Steps

    perpetualAtlanticVault.updateFunding();

    require((shares = previewDeposit(assets)) != 0, "ZERO_SHARES");

Make call for updateFunding before previewDeposit

Assessed type

Other