Closed code423n4 closed 1 year ago
We are aware of the centralization risks, initially, all contracts will have a multi-sig as owner to prevent a sole owner, later on a DAO could be the owner. Disagree with severity, should be med I guess?
TriHaz marked the issue as sponsor acknowledged
TriHaz marked the issue as disagree with severity
You will still be able to unlock and withdraw, meaning this finding looks invalid
Per the comment above, funds can be withdrawn but no new position could be created, downgrading to Low
Lines of code
https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/PairsContract.sol#L115-L119 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/TradingExtension.sol#L204-L220 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/Trading.sol#L163 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/Trading.sol#L271 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/Trading.sol#L325 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/GovNFT.sol#L307-L309 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/GovNFT.sol#L287-L294 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/Lock.sol#L126-L132 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/Lock.sol#L61-L76 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/BondNFT.sol#L357-L360 https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/BondNFT.sol#L57-L63
Vulnerability details
Malicious or compromised owner can pause assets forever
Summary
Malicious or compromised owner can pause assets without any kind of timelock or event emission, making much less trustable as assets can get locked in just a fast call.
Impact
Lock of funds
Vulnerability Details
Security pitfalls and best practices: Point 114
Token is not pausable: Malicious or compromised owners can trap contracts relying on pausable tokens.
(See here)Proof of Concept
Over the contract there are different instances of functions for pausing assets to be traded, claim rewards, etc.
This can cause the user to have locked rewards and funds that can't be traded. As this changes of the allowedAsset list are not notice by any event, this can lead into user getting assets that won't be able to trade.
https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/PairsContract.sol#L115-L119
That affects validation of trades in TradingExtension
That is later called in
Trading.sol
atinitiateMarketOrder()
,addToPosition()
andinitiateLimitOrder()
Other functions that change
allowedAsset
https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/GovNFT.sol#L307-L309This prevents users to claim their rewards https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/GovNFT.sol#L287-L294
https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/Lock.sol#L126-L132
https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/Lock.sol#L61-L76
And finally not in the user side
https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/BondNFT.sol#L357-L360
This would prevent the manager role (only set by the owner) to create bonds
https://github.com/code-423n4/2022-12-tigris/blob/0cb05a462e78c4470662e9d9a4f9ab587f266bb5/contracts/BondNFT.sol#L57-L63
Recommended Mitigation Steps
In case of wanting to keep the functionality, add an event emission in order to be able to be read off-chain and therefore notice on time.
Also add a timelock of a reasonable time in order to improve trust by the users.