Closed code423n4 closed 2 years ago
The Treasury contract and it's associated mixins were labeled as out-of-scope.
Also this report is invalid -- see https://github.com/code-423n4/2022-08-foundation-findings/issues/275#issuecomment-1215761575
Dup of #275
Lines of code
https://github.com/code-423n4/2022-08-foundation/blob/792e00df429b0df9ee5d909a0a5a6e72bd07cf79/contracts/FoundationTreasury.sol#L61
Vulnerability details
Proof of concept
FoundationTreasury.sol
inheritsCollateralManagement.sol
which has the methodthat can withdraw the whole balance of the treasury to the
to
address. It can be called only by an address that has the admin role, but inAdminRole.sol
therevokeAdmin()
functionality is external and anyone can call it. So an attacker can scan the mempool for any call towithdrawFunds
by an admin and just place a transaction that revokes this admin’s rights with higher gas than the withdraw transaction, which will result in a revert in the withdraw transaction. So a bad actor can just write a script to execute a griefing attack (he will lose gas, but won’t win anything) anytime an admin tries to withdraw.Impact
This leads to all the protocol treasury funds being stuck in it as there is no other way to get them out.
Recommendation
Revisit the
AdminRole.sol
smart contract and add access control torevokeAdmin()
method. You can make it so that only already set admins (like the one set in_initializeAdminRole()
) can revoke other admins.