Phuture Finance contest - pedroais's results

Lines of code

https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/IndexLogic.sol#L48 https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/vToken.sol#L110

Vulnerability details

Impact

All funds will be lost

Proof of Concept

To mint new index tokens underlying tokens need to be deposited in Vtoken.sol and then call the mint function.

The mint function does balance-previousBalance to calculate tokens that were deposited. The previous balance can be updated with the sync() function that anyone can call. After the user deposits tokens, an attacker can call sync() and the previous balance will be equal to the current balance. Then he can deposit a small amount of tokens.

Finally, if the user mints he will get the very small amount deposited by the attacker and his funds will be lost since the function will only deposit what was sent after the sync() function is called.

This is solved by doing the transfer and mint in only one transaction. In talks with the sponsor they said this is done in a contract that's outside scope and wasn't provided to wardens so I consider this a valid issue within the provided contracts.

Recommended Mitigation Steps

Do transfer of underlying and mint in a single transaction.

Lines of code

https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/ChainlinkPriceOracle.sol#L83

Vulnerability details

Impact

Oracle data can be stale which can lead to wrong calculations for balancing indexes.

Proof of Concept

When lastRoundData() is called only price is pulled from the provided data. RoundId should be checked to ensure the data is updated.

Recommended Mitigation Steps

(uint roundID, int BasePrice, , uint timestamp, uint answeredInRound) = baseAggregator.latestRoundData();
require(daiPrice > 0, "ChainLink: DAI price <= 0");
require(answeredInRound >= roundID, "ChainLink: Stale price");
require(timestamp > 0, "ChainLink: Round not complete");