The Vault contract syncs the highWaterMark on deposit, mint and withdraw, which can be used to avoid paying the performance fees, by performing any of these actions with a tiny amount. After Clarification with the sponsor, this was caused by a merge gone wrong and is not supposed to be there
Proof of Concept
The highWaterMark is used as a threshold to trigger the payment of a performance fee:
This modifier can be abused by performing tiny deposits, mints and withdraws to move the highWaterMark to current share values to avoid the triggering of the performance fee.
Tools Used
Manual Review
Recommended Mitigation Steps
Remove the syncFeeCheckpoint modifier and all its usages from Vault
Lines of code
https://github.com/code-423n4/2023-01-popcorn/blob/d95fc31449c260901811196d617366d6352258cd/src/vault/Vault.sol#L496-L499
Vulnerability details
Impact
The
Vault
contract syncs thehighWaterMark
on deposit, mint and withdraw, which can be used to avoid paying the performance fees, by performing any of these actions with a tiny amount. After Clarification with the sponsor, this was caused by a merge gone wrong and is not supposed to be thereProof of Concept
The
highWaterMark
is used as a threshold to trigger the payment of a performance fee:The
Vault
contains the following modifier used for deposits, mints and withdraws:This modifier can be abused by performing tiny deposits, mints and withdraws to move the
highWaterMark
to current share values to avoid the triggering of the performance fee.Tools Used
Manual Review
Recommended Mitigation Steps
Remove the
syncFeeCheckpoint
modifier and all its usages fromVault