Ajna Protocol - evmboi32's results

Lines of code

https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/PositionManager.sol#L170-L216 https://github.com/code-423n4/2023-05-ajna/blob/276942bc2f97488d07b887c8edceaaab7a5c3964/ajna-core/src/RewardsManager.sol#L207-L260

Vulnerability details

Impact

A malicious actor can force a staker to stake more memorializePositions than intended if the victim has approved tokens to PositionManager.

Proof of Concept

Bob (malicious actor) can front-run the stake function call from Alice and force her to stake more memorializePositions than she intended.

1.) Alice approves a position from bucket i and bucket j to the PositionManager
2.) She calls memorializePositions with tokenId x and provides only i in the params_.indexes array array.
3.) She decides to call stake on the RewardsManager for the token x
4.) Bob sees her tx in the mempool and frontruns it with the call to memorializePositions where he provides x as the tokenId value and j as the value params_.indexes array
5.) Alice now stakes more than she intended. To fix this she needs to unstake, redeem the unwanted j position and stake again. Since ETH fees are expensive this can cost quite a lot.

Tools Used

VS Code

Recommended Mitigation Steps

Add a mayInteract modifier to the memorializePositions function call.

Assessed type

Access Control