Closed code423n4 closed 1 year ago
trust1995 marked the issue as primary issue
trust1995 marked the issue as satisfactory
trust1995 marked the issue as satisfactory
We have overrideExchangeRate
to handle cases such as this.
Under no circumstances will there be a 500% move in the underlying price of the asset that is being tracked w/n an epoch.
If the pause is triggered the admin is assumed to correct the error from the SETTER_ADMIN
through a call to overrideExchangeRate
Link to referenced code here
ali2251 marked the issue as sponsor disputed
trust1995 marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/CashManager.sol#L305
Vulnerability details
Impact
The
lastSetMintExchangeRate
variable is not updated if exchange rate deviates the max amount. This becomes a problem since once Admin unpauses the system and new Exchange rate are being set, lastSetMintExchangeRate still points to exchange rate from last to last epoch instead of last epoch. This would highly cause system to again go in pause stateProof of Concept
Admin sets the new exchange rate for epoch 1 using the
setMintExchangeRate
functionLets say below is variable conditions
The rateDifference becomes 500-100=400. Lets say maxDifferenceThisEpoch was 300
Since
rateDifference > maxDifferenceThisEpoch
is true, below if condition executes and system is kept in pause stateAs we can see epochToExchangeRate[1] gets updated to 500 but lastSetMintExchangeRate is still 100
Lets say Admin unpause system.
This becomes a problem with next epoch.
Once Admin sets the exchange rate say 700 for epoch 3, the rate difference
exchangeRate - lastSetMintExchangeRate;
will use lastSetMintExchangeRate as 100 instead of 500, causing the rateDifference to become 600 instead of 200.Ideally this should not have failed mint check but due to lack of upgrade this causes mint check to fail
Recommended Mitigation Steps
Update the if condition to update lastSetMintExchangeRate