The deployNewMacro() function deploys a new macro for an owner and the owner can only operate the macro contract using the create, where the address derivation depends only on the LeverageMacroFactory.sol nonce. In ethereum, where this is deployed, Re-orgs has already been happened. For more info, check here
This issue will increase as some of the chains like Arbitrum and Polygon are suspicious of the reorg attacks.
The issue would happen when users rely on the address derivation in advance or try to deploy the position clone with the same address on different EVM chains, any funds sent to the new contract could potentially be withdrawn by anyone else. All in all, it could lead to the theft of user funds.
Attack Scenario
Imagine that Alice deploys a new Macro, and then sends funds to it. Bob sees that the network block reorg happens and calls deployNewMacro. Thus, it creates LeverageMacroReference with an address to which Alice sends funds. Then Alices’ transactions are executed and Alice transfers funds to Bob’s controlled LeverageMacroReference.
Lines of code
https://github.com/code-423n4/2023-10-badger/blob/f2f2e2cf9965a1020661d179af46cb49e993cb7e/packages/contracts/contracts/LeverageMacroFactory.sol#L45
Vulnerability details
Impact
The
deployNewMacro()
function deploys a new macro for an owner and the owner can only operate the macro contract using thecreate
, where the address derivation depends only on theLeverageMacroFactory.sol
nonce. In ethereum, where this is deployed, Re-orgs has already been happened. For more info, check hereThis issue will increase as some of the chains like Arbitrum and Polygon are suspicious of the reorg attacks.
The issue would happen when users rely on the address derivation in advance or try to deploy the position clone with the same address on different EVM chains, any funds sent to the new contract could potentially be withdrawn by anyone else. All in all, it could lead to the theft of user funds.
Attack Scenario Imagine that Alice deploys a new
Macro
, and then sends funds to it. Bob sees that the network block reorg happens and callsdeployNewMacro
. Thus, it createsLeverageMacroReference
with an address to which Alice sends funds. Then Alices’ transactions are executed and Alice transfers funds to Bob’s controlledLeverageMacroReference
.Proof of Concept
https://github.com/code-423n4/2023-10-badger/blob/f2f2e2cf9965a1020661d179af46cb49e993cb7e/packages/contracts/contracts/LeverageMacroFactory.sol#L45
Tools Used
Manual review
Recommended Mitigation Steps
Deploy such contracts via create2 with salt that includes msg.sender
Assessed type
Other