Dopex - tnquanghuy0512's results

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/perp-vault/PerpetualAtlanticVaultLP.sol#L199-L205

Vulnerability details

Impact

Malicious users can send 1 wei of WETH to PerpetualAtlanticVaultLP to DOS the PerpetualAtlanticVaultLP.subtractLoss() function

Proof of Concept

  function subtractLoss(uint256 loss) public onlyPerpVault {
    require(
      collateral.balanceOf(address(this)) == _totalCollateral - loss, <@@ CAN DOS THIS EASILY BY DONATION ATTACK
      "Not enough collateral was sent out"
    );
    _totalCollateral -= loss;
  }

Tools Used

Manual Review

Recommended Mitigation Steps

Change from == to >= in subtractLoss() function

-  collateral.balanceOf(address(this)) == _totalCollateral - loss
+  collateral.balanceOf(address(this)) >= _totalCollateral - loss

Assessed type

DoS

Lines of code

https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/perp-vault/PerpetualAtlanticVault.sol#L237-L241

Vulnerability details

Impact

Execute PerpetualAtlanticVault.updateFundingDuration() make every variables in this contract got affected

If we update fundingDuration to a bigger value than before, nextFundingPaymentTimestamp() will be bigger than block.timestamp, make it DOS in most functions until block.timestamp surpass nextFundingPaymentTimestamp()

Tools Used

Manual Review

Recommended Mitigation Steps

I think fundingDuration variable should not be change at all, so I'd recommend change the variable to be a constant

Assessed type

Other