Closed code423n4 closed 1 year ago
0xSorryNotSorry marked the issue as duplicate of #193
GalloDaSballo changed the severity to 2 (Med Risk)
GalloDaSballo marked the issue as duplicate of #343
This is not an inflation/donation attack. The donation in the PoC is not necessary. The described vulnerability is based on the strategy’s moving the tokens out of the contract so that withdrawal is calculated on a partial balance. But removing tokens is a functionality only an inheriting contract would have, and it would then have to be assumed that it overrides _tokenBalance()
to reflect this new state of affairs.
GalloDaSballo changed the severity to QA (Quality Assurance)
Lines of code
https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/strategies/StrategyBase.sol#L78-L101 https://github.com/code-423n4/2023-04-eigenlayer/blob/main/src/contracts/strategies/StrategyBase.sol#L121-L156
Vulnerability details
Malicious users can abuse the fact that funds will eventually be moved outside of the ecosystem and shares will be distributed at a 1:1 ratio. First, a malicious user may disrupt the 1:1 balance via the donation attack, making it so subsequent users will be given less than 1 share per token. Then, when the strategy moves funds outside, the malicious user can front-run this process again. When the strategy inevitably moves tokens back into the contract, the malicious user can front-run a withdrawal.
Proof of Concept
Suppose we have a malicious actor Alice, a user Danny, and a strategy owner Greg.
Below is a test function showing the above scenario.
Recommended Mitigation
Should not use actual balance to calculate shares, instead it should have a tracking variable.
receive()
update the tracking variable.Assessed type
Math