PoolTogether Aave v3 contest - leastwood's results

Lines of code

https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L231-L242

Vulnerability details

Impact

The supplyTokenTo() function is executed when a yield source prize pool deposits tokens into Aave to generate yield. This contract uses an internal function called _tokenToShares() to calculate how many shares to mint on behalf of the to account. Because this contract depends on aToken.balanceOf(address(this)) to determine how many shares to mint, it is possible for a malicious user to brick a newly deployed AaveV3YieldSource.sol contract by sending a large amount of aTokens and subsequently calling supplyTokenTo() such that a single share is minted.

Proof of Concept

The exploit is detailed as the following:

• Alice sends 1_000_000 aTokens directly to the contract before calling supplyTokenTo(1).
• _tokenToShares() returns _tokens when _supply == 0.
• Therefore, Alice holds a single share (wei) in the contract, which has a balance of 1_000_001 aTokens.
• Bob attempts to call supplyTokenTo() with _depositAmount equal to 1_000. _tokenToShares calculates shares equal to (1_000 * 1) / 1_000_001 which truncates to zero. As a result, no-one can deposit and mint shares without depositing more than 1_000_000 tokens.

Tools Used

• Manual code review.
• Discussions with Pierrick.

Recommended Mitigation Steps

Consider setting an initial amount of shares to mint to help mitigate this issue. This should limit the degree of truncation and inhibit how this issue could be abused.

Lines of code

https://github.com/aave/aave-v3-periphery/blob/master/contracts/rewards/RewardsController.sol#L190-L193 https://github.com/aave/aave-v3-periphery/blob/master/contracts/rewards/RewardsController.sol#L39-L42 https://github.com/aave/aave-v3-periphery/blob/master/contracts/rewards/RewardsController.sol#L133-L143 https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L275-L286

Vulnerability details

Impact

The AaveV3YieldSource contract allows the manager or owner of the contract to claim rewards from Aave's rewards controller. However, there is an external dependency on this periphery Aave contract such that the emission manager of the RewardsController contract may allows other users to be authorized claimers.

Authorized claimers can claim rewards on behalf of the AaveV3YieldSource contract, effectively bypassing any restrictions put in place by this proprietary contract and its claimRewards() function. A malicious emissions manager can effectively siphon yield away from the AaveV3YieldSource contract and redirect it to them-self.

Tools Used

• Manual code review.

Recommended Mitigation Steps

Ensure this is understood and enforce that the RewardsController contract is owner by PoolTogether's multisig.