Amun contest - pedroais's results

Handle

pedroais

Vulnerability details

Impact

Changing the entry and exit fee on the basket doesn't require a timelock. Users could be frontrunned with a higher fee before entering a basket. The issue is a low risk since there is a max cap on 10% fee so it can't be set to 100%.

Even if this attack could only be made by privileged roles adding a timelock would make the protocol more trustless.

Proof of Concept

When a user enters a basket with 0 or low fees his transaction can be frontrunned. Entry and exit fees could be changed to max which is a value the user didn't necessarily agree to.

Recommended Mitigation Steps

Add a timelock to change entry and exit fees.

Handle

pedroais

Vulnerability details

Impact

Eth could be permanently locked by mistake. The contract has a receive function but no way to extract sent funds. The exitEth function does send eth to users but extra funds in the contract's balance will still be locked.

https://github.com/code-423n4/2021-12-amun/blob/98f6e2ff91f5fcebc0489f5871183566feaec307/contracts/basket/contracts/singleJoinExit/SingleNativeTokenExit.sol#L37

Recommended Mitigation Steps

Remove receive function