Anchor contest - hubble's results

Lines of code

https://github.com/code-423n4/2022-02-anchor/blob/7af353e3234837979a19ddc8093dc9ad3c63ab6b/contracts/anchor-bAsset-contracts/contracts/anchor_basset_hub/src/config.rs#L90-L97

Vulnerability details

Updating the hub’s token contract address may lead to incorrect undelegation amounts

Impact

The hub contract allows config updates to the token_contract config values in anchor-bAsset-contracts/contracts/anchor_basset_hub/src/config.rs Such updates can cause wrong amounts of tokens to be calculated during processing of undelegations, since the amount of unbonded bLuna tokens is stored for batched unbonding as requested_with_fee.

Proof of Concept

Contract : anchor-bAsset-contracts/contracts/anchor_basset_hub/src/config.rs Function : pub fn execute_update_config(...) Line 90 :

    if let Some(token) = token_contract {
        let token_raw = deps.api.addr_canonicalize(token.as_str())?;

        CONFIG.update(deps.storage, |mut last_config| -> StdResult<Config> {
            last_config.token_contract = Some(token_raw);
            Ok(last_config)
        })?;
    }

Recommended Mitigation Steps

Its recommended to remove the ability to update token_contract config value, or asserting that requested_with_fee is zero before allowing an update of the token_contract address

Title : Missing input validation for values which should not be greater than 1

Impact

Various contracts allow update to some config or parameter values which should be never greater than 1. The input validation for such a check is missing during these update functions. In the event such values of greater than 1 are accepted, then it may result in unpredictable behavior or panic.

Proof of Concept

Listed below some of these which should be checked. #1 Config : max_borrow_factor Contract : money-market-contracts/contracts/market/src/contract.rs Function : pub fn update_config(...) Line 321 :

    if let Some(max_borrow_factor) = max_borrow_factor {
        config.max_borrow_factor = max_borrow_factor;
    }

#2 Config : base_rate Contract : money-market-contracts/contracts/interest_model/src/contract.rs Function : pub fn update_config(...) Line 74 :

    if let Some(base_rate) = base_rate {
        config.base_rate = base_rate;
    }

#3 Config : interest_multiplier Contract : money-market-contracts/contracts/interest_model/src/contract.rs Function : pub fn update_config(...) Line 78 :

    if let Some(interest_multiplier) = interest_multiplier {
        config.interest_multiplier = interest_multiplier;
    }

Recommended Mitigation Steps

Its recommended to add a check that the values for these configs are not more than 1.