Canto Application Specific Dollars and Bonding Curves for 1155s - rice_cooker's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/1155tech-contracts/src/Market.sol#L150-L169 https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/1155tech-contracts/src/Market.sol#L174-L189 https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/1155tech-contracts/src/Market.sol#L203-L221 https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/1155tech-contracts/src/Market.sol#L226-L241

Vulnerability details

Impact

In Market contract, there's no slippage protection the four function: Market::buy(), Market::sell(), Market::mintNFT(), Market::burnNFT(). Based on that, malicious user can attack vulnerable user using sandwich attack.

Proof of Concept

The path of the attack can be this:

• For the selling case: malicious user will frontrun by executing sell(), make the vulnerable user sell() received less than expected. After that malicious user will backrun by executing buy()
• For the buying case: malicious user will frontrun by executing buy(), make the vulnerable user buy() spend more token than expected. After that malicious user will backrun by executing sell()
• For the minting and burning NFT case: malicious user will not earn anything from this. But they can do sandwich attack to make user spend more fee for minting/burning

Tools Used

Manual review

Recommended Mitigation Steps

Add upperbound for spending in buy() and mintNFT and burnNFT, add lowerbound for receiving in sell()

Assessed type

Other