Bots can prevent a depeg event from being triggered for an epoch

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Controller.sol#L198 https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Controller.sol#L148

Vulnerability details

Impact

There are two functions to end an epoch: triggerDepeg() and triggerEndEpoch(). For each epoch, only one of them can be called.

triggerDepeg() can only be called if the underlying asset depegged. Under normal circumstances, you can only call triggerEndEpoch(). But, if the asset did depeg, triggerEndEpoch() is still callable.

Thus, it's possible to set up a bot that will frontrun any other tx to call triggerEndEpoch() instead of triggerDepeg(). This will mean a loss of funds for the users who deposited into the insurance vault.

Proof of Concept

triggerDepeg() can only be called if the isDisaster modifier passes: https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Controller.sol#L148

triggerEndEpoch() can always be called: https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Controller.sol#L198

If one has been called, the idFinalTVL will not be 0 and thus, the following check will fail: https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Controller.sol#L215

For each epoch, you can call either function only once.

Tools Used

none

Recommended Mitigation Steps

Instead of having two separate functions use a single function that checks for the depeg condition and acts accordingly.

[zobront]

You can only call triggerEndEpoch() after the epoch, while triggerDepeg() can be called during the epoch.

[MiguelBits]

Working as intended