Polynomial Protocol contest - sakshamguruji's results

Lines of code

https://github.com/code-423n4/2023-03-polynomial/blob/main/src/KangarooVault.sol#L436

Vulnerability details

Impact

The function removeCollateral inside kangaroo vault misses the modifier whenNotPaused , similar pattern can be seen in the exchange contract here https://github.com/code-423n4/2023-03-polynomial/blob/main/src/Exchange.sol#L131 where it uses the modifier.

Proof of Concept

The protocol expects that the removeCollateral should be called only when the modifier whenNotPaused passes , though this is checked in exchange contract , this is missing in kangaroo vault , see this test case

function testCollateralManagement() public { //POC
        uint256 amt = 1e18;
        uint256 collDelta = 1000e18;

        kangaroo.openPosition(amt, 0);
        skip(100);
        kangaroo.executePerpOrders(emptyData);
        kangaroo.clearPendingOpenOrders(0);

        (,,,,,,, uint256 initialColl,) = kangaroo.positionData();

        kangaroo.addCollateral(collDelta);

        (,,,,,,, uint256 finalColl,) = kangaroo.positionData();

        assertEq(finalColl, initialColl + collDelta);

        systemManager.setStatusFunction("EXCHANGE_REMOVE_COLLATERAL" , true);

        kangaroo.removeCollateral(collDelta);

        (,,,,,,, uint256 newColl,) = kangaroo.positionData();

        assertEq(newColl, initialColl);
    }

Tweaked this test case and added the line systemManager.setStatusFunction("EXCHANGE_REMOVE_COLLATERAL" , true); , eventhough paused the function works just fine.

Tools Used

Manual analysis

Recommended Mitigation Steps

Add the recommended modifier