Detailed description of the impact of this finding.
I've identified an instance of integer overflow within the removeLiquidity function.
This flaw enables me to manipulate the uint256 value in a way that results in its reduction to zero.
Consequently, I can exploit this situation to make a transfer exceeding my actual balance.
I've discovered an integer underflow within the removeLiquidity function.
This vulnerability enables me to manipulate the uint256 value in a manner that causes it to wrap around to the maximum value.
As a result, I can exploit this situation to transfer an amount greater than what I actually possess.
There is an underflow vulnerability on line 283 of the UniV2LiquidityAmo contract.
This allows the lpAmount to be set to its minimum and then by negating 1 or 1-2 it inflates the lpAmount to the maximum value allowed within the removeLiquidity function.
Proof of Concept
Provide direct links to all referenced code in GitHub.
function testAttackI() external payable {
uniV2LiquidityAMO = new UniV2LiquidityAMO();
...
vm.expectRevert(stdError.arithmeticError);
uniV2LiquidityAMO.removeLiquidity(uint256(1)-uint256(2)
,uint256(1)-uint256(2)
,uint256(1)-uint256(2));
...
}
Underflow Test Case Foundry
1. Deploy functions and variables above to Periphery.t.sol contract in the testAttackI function.
2. In the terminal run: ```forge test -vvv --match-path "tests/rdpxV2-core/Periphery.t.sol" --match-test "testAttackI"```
3. The account balance has been updated.
4. Done.
function testAttackI() external payable {
uniV2LiquidityAMO = new UniV2LiquidityAMO();
...
// remove liquidity
vm.expectRevert(stdError.arithmeticError);
uniV2LiquidityAMO.removeLiquidity(uint256(1)+uint256(115792089237316195423570985008687907853269984665640564039457584007913129639935)
,uint256(1)+uint256(115792089237316195423570985008687907853269984665640564039457584007913129639935)
,uint256(1)+uint256(115792089237316195423570985008687907853269984665640564039457584007913129639935));
...
}
Overflow Test Case Foundry
1. Deploy functions and variables to Periphery.t.sol contract in the testAttackI function.
2. In the terminal run: ```forge test -vvv --match-path "tests/rdpxV2-core/Periphery.t.sol" --match-test "testAttackI"```
3. The attacker account balance has been updated.
4. Done.
Lines of code
https://github.com/code-423n4/2023-08-dopex/blob/0ea4387a4851cd6c8811dfb61da95a677f3f63ae/contracts/amo/UniV2LiquidityAmo.sol#L283 https://github.com/code-423n4/2023-08-dopex/blob/eb4d4a201b3a75dd4bddc74a34e9c42c71d0d12f/contracts/amo/UniV2LiquidityAmo.sol#L279
Vulnerability details
Impact
Detailed description of the impact of this finding. I've identified an instance of integer overflow within the removeLiquidity function. This flaw enables me to manipulate the uint256 value in a way that results in its reduction to zero. Consequently, I can exploit this situation to make a transfer exceeding my actual balance. I've discovered an integer underflow within the removeLiquidity function. This vulnerability enables me to manipulate the uint256 value in a manner that causes it to wrap around to the maximum value. As a result, I can exploit this situation to transfer an amount greater than what I actually possess. There is an underflow vulnerability on line 283 of the UniV2LiquidityAmo contract.
This allows the lpAmount to be set to its minimum and then by negating 1 or 1-2 it inflates the lpAmount to the maximum value allowed within the removeLiquidity function.
Proof of Concept
Provide direct links to all referenced code in GitHub.
Add screenshots, logs, or any other relevant proof that illustrates the concept. Exploit
Exploit Underflow Foundry
Underflow Test Case Foundry
Log Underflow Foundry
Exploit Overflow Foundry
Overflow Test Case Foundry
Log Overflow Foundry
Tools Used
VS Code. Foundry. Mythx.
Recommended Mitigation Steps
Apply safemath subtract and safemath add.
Assessed type
Under/Overflow