Malt Finance contest - hagrid's results

Handle

hagrid

Vulnerability details

Some tokens (like USDT) do not work when changing the allowance from an existing non-zero allowance value. They must first be approved by zero and then the actual allowance must be approved.

Impact

When using one of these unsupported tokens, all transactions revert and the protocol cannot be used.

Proof of Concept

https://github.com/code-423n4/2021-11-malt/blob/d3f6a57ba6694b47389b16d9d0a36a956c5e6a94/src/contracts/StabilizerNode.sol#L112

https://github.com/code-423n4/2021-11-malt/blob/d3f6a57ba6694b47389b16d9d0a36a956c5e6a94/src/contracts/StabilizerNode.sol#L252

Tools Used

Manual analysis

Recommended Mitigation Steps

Safeapprove with a zero amount first before setting the actual amount.

Handle

hagrid

Vulnerability details

The withdraw(uint256 rewardAmount) function on the AbstractRewardMine contract is wrongly controlling the reward amount.

Impact

Using the withdraw function instead of withdrawAll function will cost nearly same gas amount since these functions are nearly identical.

Proof of Concept

• https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/AbstractRewardMine.sol#L71-L75
• https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/AbstractRewardMine.sol#L77-L83

Tools Used

Manual Review

Recommended Mitigation Steps

require(rewardAmount <= rewardEarned, "< earned"); The require function above should be replaced with: require(rewardAmount < rewardEarned, "< earned");

Else, both withdraw functions will be nearly identical.