Drips Protocol contest - ladboy233's results

Lines of code

https://github.com/code-423n4/2023-01-drips/blob/9fd776b50f4be23ca038b1d0426e63a69c7a511d/src/Caller.sol#L106

Vulnerability details

Impact

Authorization from Caller has no expiration time

Proof of Concept

In the current implementation of the Caller.sol, the author can authorize a sender to call function onbehalf of him.

/// @notice Grants the authorization of an address to make calls on behalf of the sender.
/// @param user The authorized address.
function authorize(address user) public {
	address sender = _msgSender();
	require(_authorized[sender].add(user), "Address already is authorized");
	emit Authorized(sender, user);
}

However, this authorization has no expiration time and is valid forever unless the caller remove the authorization.

This opens the door for several exploitation paths.

One party can use Social Engineering to make the other party authorize the call, and the authorized user can call

function callAs(address sender, address to, bytes memory data)
	public
	payable
	returns (bytes memory returnData)
{
	require(isAuthorized(sender, _msgSender()), "Not authorized");
	return _call(sender, to, data, msg.value);
}

Since the authorization has no expiration time, the malicious approved caller can really take time to perform malicious call such as perform sub-optimal trade on behalf of the sender and by the sender realized the exploit is already completeted.

Tools Used

Manual Review

Recommended Mitigation Steps

We recommend the protocol add expiration time when giving authorization to the caller.