Closed code423n4 closed 2 years ago
See ownership documentation to understand how administrators can interact with the protocol.
Since executeEmergency()
is executed in emergancy, we could add a require to check the existence of the [target]() to be sure to call the right address, but it's optional because it's a feature usable only by a Nested administrator and has to be confirmed by other administrators moreover it doesn't really matter if the tx fails, the administrator will try again.
The _dest is always the msg.sender in this case so we don't need to check for msg.sender
existance.
As the _operator.implementation is provided only by Nested administrator by using the addOperator()
function, we don't need to check for operator implementation existance.
As the pool is provided only by Nested administrator by using the addVault()
function, we don't need to check for pool existance.
As the _swapTarget is provided only by Nested administrator by using the updatesSwapTarget()
function, we don't need to check for swap target existance.
Lines of code
https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/NestedFactory.sol#L611 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/abstracts/MixinOperatorResolver.sol#L98 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/governance/TimelockControllerEmergency.sol#L283 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/governance/TimelockControllerEmergency.sol#L300 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/governance/TimelockControllerEmergency.sol#L325 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/governance/TimelockControllerEmergency.sol#L358 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/libraries/CurveHelpers/CurveHelpers.sol#L88 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/libraries/ExchangeHelpers.sol#L22 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/operators/Beefy/BeefyVaultOperator.sol#L49 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/operators/Beefy/BeefyVaultOperator.sol#L90 https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/operators/Paraswap/ParaswapOperator.sol#L34
Vulnerability details
Impact
Consider checking the recipient address for existence before making the call. If the address does not exist, call will return true and the user will not get the tokens to his wallet.
More information: https://docs.soliditylang.org/en/develop/control-structures.html#:~:text=Warning-,The%20low%2Dlevel%20functions,-call%2C%20delegatecall
Affected code:
Proof of Concept
Tools Used
Recommended Mitigation Steps