Dopex - ge6a's results

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L201 https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/perp-vault/PerpetualAtlanticVault.sol#L359 https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/core/RdpxV2Core.sol#L774

Vulnerability details

Impact

Malicious actors can send small amount of the PerpetualAtlanticVaultLP.collateral token and this way make the PerpetualAtlanticVaultLP.subtractLoss(uint256 loss) function to always revert. Consequently both functions PerpetualAtlanticVault.settle(uint256[] memory optionIds) and RdpxV2Core.settle(uint256[] memory optionIds) would also revert. The impact is that the admin of the RdpxV2Core contract would not be able to settle the options when necessary.

According the Dopex documentation and this blog post (https://blog.dopex.io/articles/dopex-papers/rdpx-v2-for-the-mentally-challenged) dpxEth is backed by 75% ETH, 25% rDPX + 25% OTM rDPX-ETH perpetual put options. These options place a backstop on rDPX of 75% of its initial value so the minimum possible backing of dpxETH is 93.75%. Using the described attack attacker could decrease the backing of dpxETH to 75% which is direct risk for the protocol and may lead to loss of funds. Adding the low cost of execution i conclude the severity should be High.

Proof of Concept

To test add this function into tests/perp-vault/Unit.t.sol

    function testSettleDosPOC() public
    {
        weth.mint(address(1), 1 ether);
        deposit(1 ether, address(1));

        vault.purchase(1 ether, address(this));

       uint256[] memory ids = new uint256[](1);
       ids[0] = 0;

       priceOracle.updateRdpxPrice(0.010 gwei); // ITM

       weth.transfer(address(vaultLp), 2 * 1e18);
       vm.expectRevert("Not enough collateral was sent out");
       vault.settle(ids);
    }

Tools Used

Manual testing, Foundry

Recommended Mitigation Steps

Replace the operator == with >=.

    function subtractLoss(uint256 loss) public onlyPerpVault {
      require(
        collateral.balanceOf(address(this)) == _totalCollateral - loss,
        "Not enough collateral was sent out"
      );
      _totalCollateral -= loss;
    }

Assessed type

DoS