-
Notifications
You must be signed in to change notification settings - Fork 5
mstpr-brainbot - First depositor can lock the quote target value to zero #48
Comments
When fix is made to #122(DODOEX/dodo-gassaving-pool#15), sellBase and sellQuote will be reverted when quote target is zero. Besides, sellShare can work normally. So we think the current fixes are sufficient and we will not make additional fixes to this issue. |
Please note that this enables any user to DOS permanently any pool upon creation (no funds loss but still a bug), not sure if the risk is acceptable There is the simple fix to check that TARGETs are not zero after first buyShares in a pool |
We fix this bug at this PR: DODOEX/dodo-gassaving-pool#16 |
Fix LGTM |
mstpr-brainbot
high
First depositor can lock the quote target value to zero
Summary
When the initial deposit occurs, it is possible for the quote target to be set to 0. This situation significantly impacts other LPs as well. Even if subsequent LPs deposit substantial amounts, the quote target remains at 0 due to multiplication with this zero value. 0 QUOTE_TARGET value will impact the swaps that pool facilities
Vulnerability Detail
When the first deposit happens, QUOTE_TARGET is set as follows:
In this scenario, the 'shares' value can be a minimum of 1e3, as indicated here: link to code snippet.
This implies that if someone deposits minuscule amounts of quote token and base token, they can set the QUOTE_TARGET to zero because the
mulFloor
operation uses a scaling factor of 1e18:Should the quote target become 0, subsequent deposits will not increase due to the multiplication with "0" on the quote target. This situation is highly problematic because the swaps depend on the value of the quote target:
https://github.com/sherlock-audit/2023-12-dodo-gsp/blob/af43d39f6a89e5084843e196fc0185abffe6304d/dodo-gassaving-pool/contracts/GasSavingPool/impl/GSPFunding.sol#L74-L75
Here a PoC shows that if the first deposit is tiny the QUOTE_TARGET is 0. Also, whatever deposits after goes through the QUOTE_TARGET still 0 because of the multiplication with 0!
Test result and logs:
Impact
Since the quote target is important and used when pool deciding the swap math I will label this as high.
Code Snippet
https://github.com/sherlock-audit/2023-12-dodo-gsp/blob/af43d39f6a89e5084843e196fc0185abffe6304d/dodo-gassaving-pool/contracts/GasSavingPool/impl/GSPFunding.sol#L31-L82
Tool used
Manual Review
Recommendation
According to the quote tokens decimals, multiply the quote token balance with the proper decimal scalor.
The text was updated successfully, but these errors were encountered: