DYAD - valentin_s2304's results

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L134

Vulnerability details

Impact

A malicious user can cause a DoS attack on the withdraw function for other users by using deposit() function in VaultManagerV2 providing the id of the victim's NFT and 0 amount for depositing into the specified vault. This will cause locked funds for the victim.

Proof of Concept

idToBlockOfLastDeposit[id] is a protection for the protocol from flash loan attacks but other users can manipulate it. Deposit function gives the right to any user to deposit for another user's NFT, the problem is there that a malicious user can call deposit function with 0 amount to cause short-term DOS to the victim.

function deposit(
    uint    id,
    address vault,
    unit amount
  ) 
    external 
      isValidDNft(id)
  {
    idToBlockOfLastDeposit[id] = block.number; //here malicious user sets the block of the last deposit to the current one which will cause prevention of user calling withdraw function
    Vault _vault = Vault(vault);
    _vault.asset().safeTransferFrom(msg.sender, address(vault), amount);
    _vault.deposit(id, amount);
  }

  /// @inheritdoc IVaultManager
  function withdraw(
    uint    id,
    address vault,
    uint    amount,
    address to
  ) 
    public
      isDNftOwner(id)
  {//ok
    if (idToBlockOfLastDeposit[id] == block.number) revert DepositedInSameBlock(); //this if statement causes the revert of the function withdraw 

    Vault _vault = Vault(vault);
    uint value = amount * _vault.assetPrice() 
                  * 1e18 
                  / 10**_vault.oracle().decimals() 
                  / 10**_vault.asset().decimals();
    if (getNonKeroseneValue(id) - value < dyadMinted) revert NotEnoughExoCollat();//ok
    _vault.withdraw(id, to, amount);
    if (collatRatio(id) < MIN_COLLATERIZATION_RATIO)  revert CrTooLow(); 
  }

Tools Used

Manual review

Recommended Mitigation Steps

use isDnftOwner modifier in deposit function or add amount == 0 check

Assessed type

DoS