Dopex - gizzy's results

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/core/RdpxV2Core.sol#L975

Vulnerability details

Impact

Adding to delegate updates totalWethDelegated but withdraw forgot to reduce the totalWethDelegated which invalidates protocol accounting . This will highly affect the sync() as it will make some contract largarly out of sync from subtracting already withdrawn ETH when syncing.

Proof of Concept

https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/core/RdpxV2Core.sol#L975C1-L991C1

  function testWithdraw() public {
   
    rdpxV2Core.addToDelegate(1 * 1e18, 10e8);
     rdpxV2Core.sync();
     (address t,uint o,) = rdpxV2Core.getReserveTokenInfo("WETH");
    console.log(o,t,weth.balanceOf(address(rdpxV2Core)));

    // test withdraw with invalid delegate id
    vm.expectRevert(
      abi.encodeWithSelector(RdpxV2Core.RdpxV2CoreError.selector, 14)
    );
    rdpxV2Core.withdraw(1);

    // test withdraw without ownership
    vm.expectRevert(
      abi.encodeWithSelector(RdpxV2Core.RdpxV2CoreError.selector, 9)
    );
    vm.prank(address(1), address(1));
    rdpxV2Core.withdraw(0);

    // test withdraw successfully
    uint256 userBalance = weth.balanceOf(address(this));
    rdpxV2Core.withdraw(0);
    assertEq(weth.balanceOf(address(this)), userBalance + 1 * 1e18);
    (, uint256 amount, , uint256 activeCollateral) = rdpxV2Core.delegates(0);
    assertEq(amount, 0);
    assertEq(activeCollateral, 0);
     rdpxV2Core.sync();
     ( t, o,) = rdpxV2Core.getReserveTokenInfo("WETH");
    console.log(o,t,weth.balanceOf(address(rdpxV2Core)));

    // test withdraw with 0 amount
    vm.expectRevert(
      abi.encodeWithSelector(RdpxV2Core.RdpxV2CoreError.selector, 15)
    );
    rdpxV2Core.withdraw(0);

    // test partial amount
    rdpxV2Core.addToDelegate(2 * 1e18, 10e8);
    uint256[] memory _amounts = new uint256[](1);
    uint256[] memory _delegateIds = new uint256[](1);
    _delegateIds[0] = 1;
    _amounts[0] = 2 * 1e18;
    userBalance = weth.balanceOf(address(this));
    (, amount) = rdpxV2Core.calculateBondCost(2e18, 0);
    rdpxV2Core.bondWithDelegate(address(this), _amounts, _delegateIds, 0);
    rdpxV2Core.withdraw(1);
    assertEq(weth.balanceOf(address(this)), userBalance + (2e18 - amount));
  }

Tools Used

manuel review

Recommended Mitigation Steps

add totalWethDelegated - amountWithdrawn

Assessed type

Error