search

code-423n4 / 2021-08-gravitybridge-findings

1 stars 0 forks source link

Actions can be frontrunned #33

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

pauliax

Vulnerability details

Impact

Anyone can watch the mempool and copy the calldata to replicate the same tx. For example, a frontrunner calculates that replicating this tx will result in profit, he watches and copies updateValset and gets rewardAmount, or submitBatch and gets totalFee, or submitLogicCall and gets feeAmounts, then instantly sell these tokens on AMM for profit. This may result in reverted txs, gas wasted, and a poor experience for legit users.

Recommended Mitigation Steps

This problem seems insurmountable in this case but you may want to consider adding restrictions on the callers or introducing any other possible prevention techniques.

jkilpatr commented 3 years ago

duplicate of #52

loudoguno commented 3 years ago

reopening as per judges assessment as "primary issue" on findings sheet