Canto Application Specific Dollars and Bonding Curves for 1155s - nazirite's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/asD/src/asD.sol#L72

Vulnerability details

Impact

The cNote token which is a fork of the CToken contract has a scaling method used to handle the exchange rate between CToken and the underlying token. This method helps scale the exchange rate because solidity doesn't handle fixed-point decimals. The formulae used to calculate the scaling factor is:(10^(10+decimals of the underlying)) In the case of the cNote the scaling factor would result in 10e28.

The bug is noted because the cNote exchange-rate is actually scaled by 1e18, which would always result in an underflow error potentially leading to a permanent DOS.

Proof of Concept

//SPDX-License-Identifier:UNLICENSED pragma solidity ^0.8;

import "forge-std/Test.sol"; import "src/asD.sol";

contract asDTest is Test { CErc20Interface cNote = CErc20Interface(0xEe602429Ef7eCe0a13e4FfE8dBC16e101049504C);

IERC20 Note = IERC20(0x4e71A2E537B7f9D9413D3991D37958c0b5e1e503);
asD asd;

address alice = makeAddr("Alice");

function setUp() external {
    vm.createSelectFork(vm.envString("CANTO_RPC_URL"));
    asd = new asD(" ASD-Token", "asD", address(this), address(cNote), address(this));
}

function testUnderflow() external {
    //make a deposit
    vm.startPrank(alice);
    //deal alice some Note Tokens to deposit
    deal(address(Note), alice, 10e18);
    //approve the asd contract
    Note.approve(address(asd), 10e18);
    asd.mint(10e18);
    vm.stopPrank();
    //calling withdrawCarry() should revert with an underflow error
    vm.expectRevert();
    //withdrawal should result in a revert
    asd.withdrawCarry(1);
}

} //logs [PASS] testUnderflow() (gas: 476608) Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 27.46s

Tools Used

Foundry

Recommended Mitigation Steps

set scaling factor to 1e18

Assessed type

Other