code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2022-12-escher/blob/main/src/minters/LPDA.sol#L92

Vulnerability details

Impact

LPDA.cancel is an owner protected function which can only be invoked before sale.startTime.

But this function can be invoked multiple times by the owner resulting in multiple invalid End event emission. Off-chain agents heavily rely on smart contract events so any unintended event emission can be used to trick off-chain elements which can cause loss of assets to the protocol.

Proof of Concept

Any account deploys a LPDA contract.
Before the sale.startTime the owner calls the cancel function.
Before the sale.startTime the owner calls the cancel function again. The transaction gets executed successfully.
Now cancel can be successfully executed any number of time by owner.

Tools Used

Manual review

Recommended Mitigation Steps

Consider adding checks which validate that cancel can be invoked only once.

c4-judge commented 1 year ago

berndartmueller changed the severity to QA (Quality Assurance)