In the function setPendingMintBalance of the CashManager.sol there is a strict uint256 not equal (!=) check inside an if statement, between oldBalance and mintRequestsPerEpoch[epoch][user]. And this function is given the role of MANAGER_ADMIN. So if the MANAGER_ADMIN decides to decrease the balance of user, then user can front run this transaction by calling requestMint() function and changing his mintRequestsPerEpoch[currentEpoch][msg.sender] value. Since the value of mintRequestsPerEpoch[currentEpoch][msg.sender] changes for the user it will no longer be equal to the oldBalance in setPendingMintBalance function. Hence the transaction will revert with UnexpectedMintBalance() error code.
Proof of Concept
if (oldBalance != mintRequestsPerEpoch[epoch][user]) {
revert UnexpectedMintBalance();
}
Above if condition can be made false by changing the mintRequestsPerEpoch[epoch][user] value, if the MANAGER_ADMIN decides to decrease the balance of the user. User can do this by calling the requestMint function and changing the mintRequestsPerEpoch[currentEpoch][msg.sender] using below line of code.
Hence the user can claim more token balance before the MANAGER_ADMIN can change the balance amount using the setPendingMintBalance command.
Tools Used
Manual Review.
Recommended Mitigation Steps
Should prevent user from calling the requestMint function while setPendingMintBalance function is being called by the MANAGER_ADMIN.
This can be done by using boolean values and changing thier state accordingly when setPendingMintBalance function is called.
Lines of code
https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/cash/CashManager.sol#L336-L350
Vulnerability details
Impact
In the function
setPendingMintBalance
of the CashManager.sol there is a strict uint256 not equal (!=) check inside anif
statement, betweenoldBalance
andmintRequestsPerEpoch[epoch][user]
. And this function is given the role ofMANAGER_ADMIN
. So if theMANAGER_ADMIN
decides to decrease the balance ofuser
, thenuser
can front run this transaction by callingrequestMint()
function and changing hismintRequestsPerEpoch[currentEpoch][msg.sender]
value. Since the value ofmintRequestsPerEpoch[currentEpoch][msg.sender]
changes for theuser
it will no longer be equal to theoldBalance
insetPendingMintBalance
function. Hence the transaction will revert withUnexpectedMintBalance()
error code.Proof of Concept
Above if condition can be made false by changing the
mintRequestsPerEpoch[epoch][user]
value, if the MANAGER_ADMIN decides to decrease the balance of the user. User can do this by calling therequestMint
function and changing themintRequestsPerEpoch[currentEpoch][msg.sender]
using below line of code.Hence the user can claim more token balance before the MANAGER_ADMIN can change the balance amount using the
setPendingMintBalance
command.Tools Used
Manual Review.
Recommended Mitigation Steps
Should prevent user from calling the
requestMint
function whilesetPendingMintBalance
function is being called by the MANAGER_ADMIN. This can be done by using boolean values and changing thier state accordingly whensetPendingMintBalance
function is called.