Platform: Code4rena
Start Date: 18/10/2022
Pot Size: $75,000 USDC
Total HM: 27
Participants: 144
Period: 7 days
Judge: gzeon
Total Solo HM: 13
Id: 170
League: ETH
Rank: 98/144
Findings: 2
Award: $1.97
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: minhtrng
Also found by: Deivitto, V_B, __141345__, adriro, cdahlheimer, d3e4, ladboy233, nadin, teawaterwire
Because of the pseudo-randomness of the random variable
uint256 random = uint256(keccak256(abi.encodePacked(jobHash, _jobNonce(), block.number, block.timestamp)));
an operator could front-run calls to crossChainMessage() to join the right pod at the right index to be selected immediately for a job
using a custom contract, an attacker can pass jobHash and the nonce to a function that will then be able to compute the random variable (by copying the exact line of code above)
then inside that same function, they can call the external function getTotalPods thus deducing which pod will be selected
by calling the other external function getPodOperatorsLength they can deduce the index that would be selected should they join that pod
if the index ends up being 0 or the last one, they it means they can join that pod
if not the transaction can revert allowing to submit at no cost through Flashbots.
maybe adding a cooling period before an operator can unbondUtilityToken
#0 - gzeoneth
2022-10-30T17:14:51Z
Duplicate of #27
🌟 Selected for report: Rolezn
Also found by: 0x1f8b, 0x52, 0x5rings, 0xNazgul, 0xSmartContract, 0xZaharina, 0xhunter, 0xzh, 8olidity, Amithuddar, Aymen0909, B2, Bnke0x0, Chom, Deivitto, Diana, Diraco, Dravee, Franfran, JC, Jeiwan, Josiah, JrNet, Jujic, KingNFT, KoKo, Lambda, Margaret, Migue, Ocean_Sky, PaludoX0, Picodes, Rahoz, RaoulSchaffranek, RaymondFam, RedOneN, ReyAdmirado, Shinchan, Tagir2003, Trust, Waze, Yiko, __141345__, a12jmx, adriro, ajtra, arcoun, aysha, ballx, bin2chen, bobirichman, brgltd, bulej93, catchup, catwhiskeys, caventa, cccz, cdahlheimer, ch0bu, chaduke, chrisdior4, cloudjunky, cryptostellar5, cryptphi, csanuragjain, cylzxje, d3e4, delfin454000, djxploit, durianSausage, erictee, fatherOfBlocks, francoHacker, gianganhnguyen, gogo, hansfriese, i_got_hacked, ignacio, imare, karanctf, kv, leosathya, louhk, lukris02, lyncurion, m_Rassska, malinariy, martin, mcwildy, mics, minhtrng, nicobevi, oyc_109, pashov, peanuts, pedr02b2, peiw, rbserver, ret2basic, rotcivegaf, rvierdiiev, ryshaw, sakman, sakshamguruji, saneryee, securerodd, seyni, sikorico, svskaushik, teawaterwire, tnevler, w0Lfrum
0 USDC - $0.00
Anyone can call bondUtilityToken for an operator, there is no check on msg.sender
not a critical finding, but could be used as grieving attack to prevent an operator to bond to a particular pod by front-running them and bonding them to another pod (though the operator could still withdraw from that pod and join another one)
maybe a check on msg.sender == operator to be safe
#0 - alexanderattar
2022-11-09T21:56:16Z
Anyone should be able to bond. There is no way to check if someone is running the operator CLI from the chain