Open c4-submissions opened 11 months ago
gzeon-c4 marked the issue as satisfactory
gzeon-c4 marked the issue as unsatisfactory: Insufficient proof
Besides sandwiching is usually out-of-scope, warden's POC of Alice and Bob acting together failed to show it is profitable as an attack.
Hey @gzeon-c4 , this is not just a sandwich, the main point is lack of health factor check. Sponsor has confirmed and fixed this in PR17 . The attack is profitable because originally Alice should not be able to remove all the collateral since she has outstanding debt but now she will be able to do so.
gzeon-c4 removed the grade
gzeon-c4 marked the issue as satisfactory
gzeon-c4 marked the issue as selected for report
Lines of code
https://github.com/GoodEntry-io/ge/blob/c7c7de57902e11e66c8186d93c5bb511b53a45b8/contracts/PositionManager/OptionsPositionManager.sol#L454
Vulnerability details
Attacker can drain the lending pool by leveraging two facts:
swapAll
allows 1% slippageclose
.Alice and Bob are good friends, the steps are (in one single tx):
close
but only repays 1 wei debt. The real intention is to swap from USDT collateral to ETH collateral.close
but only repays 1 wei debt to swap to USDT collateral.By continues sandwiching Alice, Bob can extract value from the pool. A simple mitigation is to add a HF check after each swap.
Assessed type
Context