search

Cyfrin / 2023-07-foundry-defi-stablecoin

37 stars 32 forks source link

Frontrunning Vulnerability in liquidate Function #1141

Closed codehawks-bot closed 1 year ago

codehawks-bot commented 1 year ago

Frontrunning Vulnerability in liquidate Function

Severity

High Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/main/src/DSCEngine.sol#L229-L262

Summary

The liquidate function is susceptible to frontrunning, as it does not have a mechanism to verify who acted on the undercollateralized position first.

Vulnerability Details

The function allows a user to liquidate undercollateralized positions by paying off a portion of the debt and receiving collateral plus a bonus in return. It can be called by anyone who can cover the debt. However, it's susceptible to frontrunning because anyone observing the transaction pool can submit a similar transaction with a higher gas fee to be processed first.

Impact

This vulnerability could lead to unfair advantages for users with higher resources to pay for gas fees, potentially undermining the fairness and integrity of the system.

Tools Used

Manual review

Recommendations

Enhance the transaction processing rules to prevent frontrunning

hans-cyfrin commented 1 year ago

Invalid. Front running with the same liquidation purpose is not the protocol's concern.