Revert Lend - tpiliposian's results

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/transformers/LeverageTransformer.sol#L40-L96 https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/transformers/LeverageTransformer.sol#L123-L175

Vulnerability details

Impact

The LeverageTransformer.sol contract has leverageUp and leverageDown functions, which are intended to be called from the V3Vault.sol contract. However, the mentioned functions lack proper msg.sender validation, which allows malicious contracts to call those functions and steal stuck funds on the contract.

Proof of Concept

For a malicious contract to steal stuck funds, the following things must be true about the state of the contract.

1. There must be an NFT in the nonfungiblePossitionManager with the tokens that the attacker wants to steal.
2. One of two tokens of the position NFT must be stuck on the contract. If those two things are true the attacker can create a malicious contract with the function asset() and borrow() and call the leverageUp or leverageDown function through the malicious contract in a way that enables them to steal the stuck funds.

    function leverageUp(LeverageUpParams calldata params) external {
        uint256 amount = params.borrowAmount;

        address token = IVault(msg.sender).asset();

        IVault(msg.sender).borrow(params.tokenId, amount);

[...]

        // send leftover tokens
        if (amount0 > added0) {
            SafeERC20.safeTransfer(IERC20(token0), params.recipient, amount0 - added0);
        }
        if (amount1 > added1) {
            SafeERC20.safeTransfer(IERC20(token1), params.recipient, amount1 - added1);
        }
        if (token != token0 && token != token1 && amount > 0) {
            SafeERC20.safeTransfer(IERC20(token), params.recipient, amount);
        }
    }

    function leverageDown(LeverageDownParams calldata params) external {
        address token = IVault(msg.sender).asset();

[...]

        IVault(msg.sender).repay(params.tokenId, amount, false);

        // send leftover tokens
        if (amount0 > 0 && token != token0) {
            SafeERC20.safeTransfer(IERC20(token0), params.recipient, amount0);
        }
        if (amount1 > 0 && token != token1) {
            SafeERC20.safeTransfer(IERC20(token1), params.recipient, amount1);
        }
    }

Tools Used

Manual review.

Recommended Mitigation Steps

Consider adding a mechanism for checking the msg.sender and the following check in the code:

require( msg.sender == Vaultaddr )

Assessed type

Invalid Validation