search

code-423n4 / 2021-04-maple-findings

0 stars 0 forks source link

Bypass or reduction on the lockup period. #114

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

In Pool.sol, the lockup restriction of withdrawal can be bypassed or reduced if new liquidity providers cooperate with existing ones.

Proof of Concept

  1. A liquidity provider Alice deposits liquidity assets into the pool and gained some FDTs. She then waits for lockupPeriod days and calls intendToWithdraw to pass her withdrawal window. Now she is available to withdraw her funds and also allowed to receive FDTs.
  2. A new liquidity provider Bob deposits liquidity assets into the pool and gained some FDTs. Currently, he is not allowed to withdraw his funds by the design of protocol.
  3. Bob and Alice agree to cooperate with each other. Bob transfers his FDT to Alice via the _transfer function.
  4. Alice then withdraws the amount of FDT from Bob. Since the depositDate is calculated using a weighted timestamp, the period of locking is decreased. In cases when the deposit Alice is much larger than Bob, Bob only needs to wait for the withdrawCooldown period before he could withdraw his funds.

Tools Used

None

Recommended Mitigation Steps

Recalculate depositDate every tranfer occurs.

lucas-manuel commented 3 years ago

Duplicate of #117