DYAD - ubl4nk's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/4a987e536576139793a1c04690336d06c93fca90/src/core/VaultManagerV2.sol#L127 https://github.com/code-423n4/2024-04-dyad/blob/4a987e536576139793a1c04690336d06c93fca90/src/core/VaultManagerV2.sol#L143

Vulnerability details

Impact

Attacker can DoS the VaultManagerV2::deposit function and the dNFT owner will be unable to withdraw.

Proof of Concept

• dNFT owner calls withdraw:

function withdraw(
    uint    id,
    address vault,
    uint    amount,
    address to
  ) 
    public
      isDNftOwner(id)
  {
    if (idToBlockOfLastDeposit[id] == block.number) revert DepositedInSameBlock();

it is checking if any amount is deposited into any vault of this dNFT in the same block, then it reverts the transaction (this mean deposit/withdraw can't happen in the same block).

• Attacker front-runs the dNFT-owner transaction and calls deposit and deposits 1 wei of the vault asset, so the idToBlockOfLastDeposit[id] will be updated.
• dNFT owner's transaction will be reverted.
• Attacker can repeat this task for many hours/days/weeks/etc.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider adding a minimum limit for deposit amount.

Assessed type

DoS