Yeti Finance contest - gpersoon's results

Handle

gpersoon

Vulnerability details

Impact

The function addColl() checks that no duplicate collateral types are send. The function withdrawColl() does the reverse of function addColl() and also has parameters which list the requested collateral types to retrieve. However there is no check on duplicate collaterals. Trying to retrieve the same collateral twice might have unexpected side effects.

Proof of Concept

https://github.com/code-423n4/2021-12-yetifinance/blob/1da782328ce4067f9654c3594a34014b0329130a/packages/contracts/contracts/BorrowerOperations.sol#L373-L385

function withdrawColl( address[] memory _collsOut,  uint256[] memory _amountsOut,  address _upperHint,  address _lowerHint ) external override {
        AdjustTrove_Params memory params;
        params._collsOut = _collsOut;
        params._amountsOut = _amountsOut;
        params._upperHint = _upperHint;
        params._lowerHint = _lowerHint;
        _adjustTrove(params);
    }

https://github.com/code-423n4/2021-12-yetifinance/blob/1da782328ce4067f9654c3594a34014b0329130a/packages/contracts/contracts/BorrowerOperations.sol#L346-L370

function addColl(  address[] memory _collsIn,  uint256[] memory _amountsIn,   address _upperHint,   address _lowerHint,   uint256 _maxFeePercentage  ) external override {
         ...
        // check that all _collsIn collateral types are in the whitelist and no duplicates
        _requireValidDepositCollateral(params._collsIn);
         ...
        _adjustTrove(params);
    }

https://github.com/code-423n4/2021-12-yetifinance/blob/1da782328ce4067f9654c3594a34014b0329130a/packages/contracts/contracts/BorrowerOperations.sol#L871-L876

 function _requireValidDepositCollateral(address[] memory _colls) internal view {
        _requireNoDuplicateColls(_colls);
        for (uint256 i = 0; i < _colls.length; i++) {
            require(whitelist.getIsActive(_colls[i]), "BOps: Collateral not in whitelist");
        }
    }

Tools Used

Recommended Mitigation Steps

Call _requireValidDepositCollateral() or _requireNoDuplicateColls() from withdrawColl()