Tigris Trade contest - mookimgo's results

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/Position.sol#L148

Vulnerability details

Impact

Malicious user can use a contract call initiateLimitOrder and get a callback in the Position._safeMint, and then call cancelLimitOrder to burn the position NFT in this callback before _limitOrders and _limitOrderIndexes get updated.

In this case the burn function https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/Position.sol#L264 will wrongly operate _limitOrderIndexes and _limitOrders.

Proof of Concept

todo

Tools Used

manual audit

Recommended Mitigation Steps

use _mint instead of _safeMint to avoid callback

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/Lock.sol#L117

Vulnerability details

Impact

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/Lock.sol#L117

    /**
     * @notice Claim rewards from gov nfts and distribute them to bonds
     */
    function claimGovFees() public {
        address[] memory assets = bondNFT.getAssets();

        for (uint i=0; i < assets.length; i++) {
            uint balanceBefore = IERC20(assets[i]).balanceOf(address(this));
            IGovNFT(govNFT).claim(assets[i]);
            uint balanceAfter = IERC20(assets[i]).balanceOf(address(this));
            IERC20(assets[i]).approve(address(bondNFT), type(uint256).max);
            bondNFT.distribute(assets[i], balanceAfter - balanceBefore);
        }
    }

Some ERC20 require approve set to zero before a approve can be done, like USDT https://etherscan.io/token/0xdac17f958d2ee523a2206206994597c13d831ec7#code

require(!((_value != 0) && (allowed[msg.sender][_spender] != 0)));

So if USDT is added as an bondNFT asset, this approve call we be fail, and the claimGovFees will revert, causing DoS.

Proof of Concept

Code given above

Tools Used

None

Recommended Mitigation Steps

Remove approve and just send asset to bondNFT contract