Canto contest - p4st13r4's results

Lines of code

https://github.com/Plex-Engineer/manifest/blob/688e9b4e7835854c22ef44b045d6d226b784b4b8/contracts/Proposal-Store.sol#L49

Vulnerability details

Impact

Affected code:

• https://github.com/Plex-Engineer/manifest/blob/688e9b4e7835854c22ef44b045d6d226b784b4b8/contracts/Proposal-Store.sol#L49

The function AddProposal() allows anyone to manipulate the mapping of proposals, which means that anyone is able to add new proposals, as well as to replace existing ones. This is malicious behaviour which could led to governance wrongdoings

Tools Used

Editor

Recommended Mitigation Steps

The function is possibly missing some access control guard. Anyway, the contract should keep a lastProposal variable, use it anytime a new proposal is created, and increment it later

Lines of code

https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L43 https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L54 https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L114 https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L198 https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L214 https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L310

Vulnerability details

Impact

Affected code:

• https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L43
• https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L54
• https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L114
• https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L198
• https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L214
• https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L310

When calling borrowFresh(), the contract checks that initial balance of Note for the contract itself is zero and that after the mint the balance is exactly equal to the mint amount. This is very dangerous because an attacker could transfer 1 wei to the contract and make impossible for everybody to actually borrow any money.

This checks are spread into all the other functions of the contract: repayBorrowFresh(), mintFresh(), redeemFresh(). The impact is exactly the same (DOS), but during different phases of the interactions with the contract.

Proof of Concept

1. Attacker deposit 1 wei of Note to CNote.sol contract
2. Now anyone that calls borrowFresh has the tx revert with the reason CNote::borrowFresh:Impossible reserves in CNote market Place

Tools Used

Editor

Recommended Mitigation Steps

Remove the checks for zero amounts, and transform the == checks into >= checks

Lines of code

https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/WETH.sol#L47

Vulnerability details

Impact

Affected code:

• https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/WETH.sol#L47

WETH.sol is almost copied from the infamous WETH contract that lives in mainnet. This contract is supposed to receive the native currency of the blockchain (for example ETH) and wrap it into a tokenized, ERC-20 form. This contract computes the totalSupply() using the balance of the contract itself stored in the balanceOf mapping, when instead it should be using the native balance function. This way, totalSupply() always returns zero as the WETH contract itself has no way of calling deposit to itself and increase its own balance

Proof of Concept

1. Alice transfers 100 ETH to WETH.sol
2. Alice calls balanceOf() for her address and it returns 100 WETH
3. Alice calls totalSupply(), expecting to see 100 WETH, but it returns 0

Tools Used

Editor

Recommended Mitigation Steps

function totalSupply() public view returns (uint) {
    return address(this).balance
}

Lines of code

https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/Note.sol#L13

Vulnerability details

Impact

Affected code:

• https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/Note.sol#L13

The function _mint_to_Accountant() is supposed to be called after contract initialization, so that the accountant is immediately set and all the tokens are mint to them. However, this function completely lacks any access control (it’s just external) so an attacker can monitor the mempool and frontrun the transaction in order to become accountant and own all the Note tokens

Tools Used

Editor

Recommended Mitigation Steps

The function should have a guard that regulates access control

Lines of code

https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L14

Vulnerability details

Impact

Affected code:

• https://github.com/Plex-Engineer/lending-market/blob/ab31a612be354e252d72faead63d86b844172761/contracts/CNote.sol#L14

The function _setAccountantContract() is supposed to be called after contract initialization, so that the accountant is immediately set. However, this function completely lacks any access control (it’s just public) so an attacker can monitor the mempool and frontrun the transaction in order to become both accountant and admin

Tools Used

Editor

Recommended Mitigation Steps

The function should:

1. have a guard that regulates access control
2. not set the admin too, which is dangerous and out of scope