Closed code423n4 closed 1 year ago
How would a malicious factory be deployed? Attempting to deploy the factory to the same address that already exists would revert because a contract is already deployed to that address.
kyscott18 requested judge review
berndartmueller marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2023-01-numoen/blob/2ad9a73d793ea23a25a381faadc86ae0c8cb5913/src/periphery/LiquidityManager.sol#L104-L114
Vulnerability details
Impact
Detailed description of the impact of this finding. The
LiquidityManager.pairMintCallback()
might be exploited to steal funding from another user due to three issues: 1)LiquidityManager.pairMintCallback()
is a callback function for theaddLiquidity()
, which requires a user to approve theLiquidityManage
some amount of allowance ontoken0
andtoken1
.2) If a malicious user can call
LiquidityManager.pairMintCallback()
directly, then she/he can steal fund from another liquidity providor. This can happen when the contractfactory
is compromised.3)
LiquidityManager.pairMintCallback()
has no detection thatfactory
is original or compromised.Proof of Concept
Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
We show how the
LiquidityManager.pairMintCallback()
might be exploited to steal funding from another user:1) Suppose a liquidity provider Alice likes to call
addLiquidity()
, but before that she approves 10M of token0 and 5M of token1 to theLiquidityManager
.2) A malicious user obtains the account of the deployer of
factory
and then use recreat2 to deploy a maliciousfactory
, and from the malicious factory, a new maliciouslendgine
contract is deployed at the same address of an old one using recreat2.3) The malicious
Lendgine
can call theLiquidityManager.pairMintCallback()
directly, stealing fund from Alice using the following lines:where
decoded.payer
is Alice's address and now all 10M oftoken0
and 5M oftoken1
will be sent to the maliciousLendgine
.Tools Used
Remix
Recommended Mitigation Steps
Use
EXTCODEHASH
(https://soliditydeveloper.com/extcodehash) to check that the codeHash of the calculated address is indeed to the codeHash for theLendgine
by a looking up of codeHash in the factory.