code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/package.json#L14 https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L35-L35

Vulnerability details

Impact

It is possible for initializer() protected functions to be executed twice, if this happens in the same transaction. For this to happen, either one call has to be a subcall to the other, or both calls have to be subcalls of a common initializer() protected function. This can be particularly dangerous if the initialization is not part of the proxy construction, and reentrancy is possible by executing an external call to an untrusted address. https://snyk.io/test/npm/@openzeppelin/contracts/3.4.2-solc-0.7#SNYK-JS-OPENZEPPELINCONTRACTS-2320176

Proof of Concept

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/package.json#L14

    "@openzeppelin/contracts": "^3.4.2-solc-0.7",

https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/contracts/wfCashBase.sol#L35-L35

    function initialize(uint16 currencyId, uint40 maturity) external override initializer {

Tools Used

Manual.

Recommended Mitigation Steps

Upgrade to @openzeppelin/contracts@4.4.1+.

berndartmueller commented 2 years ago

Duplicate #145

Brownie is used to install dependencies and compile the contracts, using this outdated version declared in the package.json does not impose any risks qualified as medium severity.

I submitted this finding as low in #215 - [L-08] Contracts are using outdated OpenZeppelin version ^3.4.2-solc-0.7

jeffywu commented 2 years ago

OZ versions are used here (@4.5.0) https://github.com/code-423n4/2022-06-notional-coop/blob/6f8c325f604e2576e2fe257b6b57892ca181509a/notional-wrapped-fcash/brownie-config.yml#L7-L8

gzeoneth commented 2 years ago

https://github.com/code-423n4/2022-06-notional-coop-findings/issues/145