code423n4 commented 3 years ago

Handle

leastwood

Vulnerability details

Impact

The flashLoan() function enables users to access instant liquidity from asset reserves or by directly minting usdm tokens. An external call is made to a recipient contract which adheres to the IERC3156FlashBorrower interface before transferring the amount and fee back to the contract. As a result, there may be unintended consequences if a user could reenter and effectively receive more tokens than they need to transfer back to the contract. Currently, this is not exploitable but an alternative attack vector may enable an attacker to steal funds.

Proof of Concept

https://github.com/code-423n4/2021-10-mochi/blob/main/projects/mochi-core/contracts/vault/MochiVault.sol#L356-L373 https://github.com/code-423n4/2021-10-mochi/blob/main/projects/mochi-core/contracts/assets/usdm.sol#L59-L76

Tools Used

Manual code review

Recommended Mitigation Steps

Consider utilising OpenZeppelin's ReentrancyGuard library to prevent users from reentering the flashLoan() function.

r2moon commented 3 years ago

I don't think so. if user re-enter, he need to pay double fees.

ghoul-sol commented 3 years ago

best practices as there's no explicit exploit at this time

code-423n4 / 2021-10-mochi-findings