Overlay Protocol contest - hubble's results

Handle

hubble

Vulnerability details

Using/importing openZeppelin version 4.3.2 file ERC1155Supply.sol which has a security advisory. Reference : https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-wmpv-c2jp-j2xg

Proof of Concept

File : collateral/OverlayV1OVLCollateral.sol line 7: import "@openzeppelin/contracts/token/ERC1155/extensions/ERC1155Supply.sol";

File : brownie-config.yaml line 23: dependencies:

• OpenZeppelin/openzeppelin-contracts@4.3.2

Tools Used

Manual review

Recommended Mitigation Steps

Upgrade the openzeppelin ERC1155Supply.sol dependency version to 4.3.3

Handle

hubble

Vulnerability details

Impact

The function _transferMint is called by both transferFromMint and transferMint which again is used while issuing shares when a user takes a position in OI.

Proof of Concept

File : ovl/OverlayToken.sol file line 268 : function _transferMint( address sender, address recipient, uint256 amount, uint256 minted ) internal {

    uint256 senderBalance = _balances[sender];

    require(senderBalance >= amount, "ERC20: transfer amount exceeds balance");

    unchecked { _balances[sender] = senderBalance - amount; }

    _balances[recipient] += amount + minted;

    emit Transfer(sender, recipient, amount);
    emit Transfer(address(0), recipient, minted);

}

Tools Used

Manual review

Recommended Mitigation Steps

Increment the totalSupply as is done in _mint() _totalSupply += minted;