search

code-423n4 / 2023-06-reserve-findings

1 stars 0 forks source link

Malicious actor can call rebalance with TradeKind for dutch auction when gas prices are big to make losses for system #45

Open code423n4 opened 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/reserve-protocol/protocol/blob/c4ec2473bbcb4831d62af55d275368e73e16b984/contracts/p1/BackingManager.sol#L99-L161

Vulnerability details

Impact

Malicious actor can call rebalance with TradeKind for dutch auction when gas prices are big to make losses for system. Because bidding with Dutch auction is costly for users, system will receive much less tokens for the trade than expected.

Proof of Concept

BackingManager.rebalance can be called by anyone. User should provide type of auction that will be used: Gnosis or Dutch. The difference between them now is that Gnosis can be settled by anyone(he pays for gas), while Dutch auction should be settled by bidder. And this settle process is costly, because it will call rebalance for user again.

Because Dutch auction takes a lot of gas from user that means that they will pay less amount for the traded assets to compensate that gas. The more busy main net and bigger gas prices, the less bidders would like to pay.

Malicious user in times when gas prices are high can call(frontrun another users) BackingManager.rebalance with Dutch auction in order to make system lose part of their collateral.

Tools Used

VsCode

Recommended Mitigation Steps

I don't know how to handle this.

Assessed type

Error

c4-judge commented 1 year ago

0xean changed the severity to QA (Quality Assurance)