Caviar Private Pools - oxen's results

Lines of code

https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L459

Vulnerability details

Impact

Owner steals NFT/ERC depending on what the victim approved and intended to sell/buy/exchange to the PrivatePool.

Proof of Concept

• Step 1: Victim sends approval of NFT/ERC20 for the PrivatePool
• Step 2: Malicious Owner of PrivatePool listens to the Mempool and backruns the transaction

The transaction of "Step 2" would safeTransfer from the Victim to an attacker controlled address.

Note

Please note that this vulnerability has broader scope than the automated finding of M-1: Centralization Risk for trusted owners. Centralization risk would be the owner doing something with the funds of the pool. Not the owner doing something with funds that were intended to be exchanged for something.

Recommended Mitigation Steps

At the minimum the execute function should disallow calls to the baseToken (if ERC pool) and the NFT contract. Better would be to add a time delay on the execute function as some contracts have multiple entry points and simply disallowing calls to the ERC/NFT would not work.