Putty contest - itsmeSTYJ's results

Lines of code

https://github.com/code-423n4/2022-06-putty/blob/main/contracts/src/PuttyV2.sol#L268

Vulnerability details

Impact

The permissionless nature of Putty will encourage bait and switch scams. The malicious user will first create a token with a broken transfer function (reverts if certain conditions are met) and provide liquidity for it on a DEX. This user will then make a "fat fingered" options order (even with very reasonable parameters to make it look legitimate) to entice takers to fill the short side of it. Non technical takers will attempt to buy said these malicious tokens off the DEX only to realise that they cannot be transferred out of their addresses.

The order is effectively a honey pot to trap innocent users as the malicious user is able to withdraw the funds from the DEX once it is done..

Recommended Mitigation Steps

• Since the owner role already exists, leverage on it to whitelist certain ERC20 or ERC721 addresses that can be used to trade on Putty. Think Pareto's principle!

Lines of code

https://github.com/code-423n4/2022-06-putty/blob/main/contracts/src/PuttyV2.sol#L287

Vulnerability details

Impact

A malicious maker who:

1. won't exercise their long option
2. is willing to have their assets "stuck"

can intentionally create a "fat fingered" long option (i.e. very profitable for any taker to fill the short side) with 9999 days on the duration and 0 premiums. An opportunistic but amateur user might be tempted to fill the short side. This will lead to their funds being stuck for 27 years since the maker has no intention of exercising his options.

Note that a competitor platform might take this approach to create FUD / DOS users of Putty.

Recommended Mitigation Steps

• Use a more reasonable / common values when checking the duration of the order to be filled.
• Add more / improve heuristics to ensure that the order being filled is a "sane" order.
• Indicate clearly on the UI of any potential anomalies