Sushi Miso contest - tensors's results

Part of the Sushi’s product ecosystem in advancing seamless token and auction launchpad for projects.

General Information

Platform: Code4rena

Start Date: 09/09/2021

Pot Size: $100,000 SUSHI

Total HM: 4

Participants: 11

Period: 7 days

Judge: ghoulsol

Total Solo HM: 3

Id: 28

League: ETH

Sushi

Findings Distribution

Researcher Performance

Rank: 4/11

Findings: 2

Award: $4,639.55

🌟 Selected for report: 1

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: WatchPug

Also found by: 0xRajeev, cmichel, tensors

Labels

bug
duplicate
3 (High Risk)

Awards

272.6038 SUSHI - $2,734.22

External Links

Handle

tensors

Vulnerability details

Impact

A comment in the code asks whether it is safe to allow anyone to call PostAuctionLauncher, finalize(). In the case that an attacker can get even a few wei of the auction token, it is not safe.

Suppose an attacker somehow gets a small amount of the auction token before the token (many projects do small token giveaways to contributors, community members, nft artists, code423n4 auditors, etc.) before the official launch.

The attacker can then create a massively skewed pool for the token. Since you are using the low level .mint() call in the code, "slippage" on your mint could be very high. The attacker calls your .finalize method (giving you close to 0 LP tokens because of the skewed pool) and then .burns() his liquidity taking almost the entire pool on his burn.

Proof of Concept

https://github.com/sushiswap/miso/blob/2cdb1486a55ded55c81898b7be8811cb68cfda9e/contracts/Liquidity/PostAuctionLauncher.sol#L220-L222

Don't let anyone but the owner call the function.

#0 - Clearwood

2021-09-16T04:36:08Z

duplicate of #14

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter