Sherlock contest - jonah1005's results

Handle

jonah1005

Vulnerability details

Impact

In PoolOpen contract, pools' authentication is done through baseData. However, it handles token transfer based on the given parameter token. By appending a real token address at the end of the transaction and a fake address in the function parameter, attackers can stake an unlimited amount.

Proof of Concept

A simple exploit would be:

data = sherlock.encodeABI(fn_name='stake', args = [1*10**18, w3.eth.accounts[0], fake_token.address])
w3.eth.send_transaction({'from': admin, 'to': sherlock.address, 'data': data+dai.address[2:]})

baseData queries dai's pool while the contract charges the user's fakeToken

Tools Used

hardhat

Recommended Mitigation Steps

The usage of baseData() is dangerous. The little benefit of gas efficiency comes with great cost in readibility. I recommend the dev using standard solidity.

PoolStrategy, PoolBase, and PoolOpen use the same pattern. There's should be a few exploits in these contracts. Since the root cause is similar, I skip those issues in order to not spam the system. I recommend the team check all these contracts if baseData is needed.