Closed code423n4 closed 1 year ago
https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/CashManager.sol#L821
MANAGER_ADMIN can set a very high value for minimumRedeemAmount which will ensure that all attempt to redeem amount simply fails
MANAGER_ADMIN
User A wants to redeem amount 100000 using the requestRedemption function
requestRedemption
Before User A can do so, MANAGER_ADMIN simply updates the minimumRedeemAmount to 100001 using the setRedeemMinimum function
setRedeemMinimum
function setRedeemMinimum( uint256 newRedeemMinimum ) external onlyRole(MANAGER_ADMIN) { uint256 oldRedeemMin = minimumRedeemAmount; minimumRedeemAmount = newRedeemMinimum; emit MinimumRedeemAmountSet(oldRedeemMin, minimumRedeemAmount); }
if (amountCashToRedeem < minimumRedeemAmount) { revert WithdrawRequestAmountTooSmall(); }
Add a max cap for minimumRedeemAmount which will prevent such scenarios
trust1995 marked the issue as unsatisfactory: Out of scope
Lines of code
https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/CashManager.sol#L821
Vulnerability details
Impact
MANAGER_ADMIN
can set a very high value for minimumRedeemAmount which will ensure that all attempt to redeem amount simply failsProof of Concept
User A wants to redeem amount 100000 using the
requestRedemption
functionBefore User A can do so, MANAGER_ADMIN simply updates the minimumRedeemAmount to 100001 using the
setRedeemMinimum
functionRecommended Mitigation Steps
Add a max cap for minimumRedeemAmount which will prevent such scenarios